IPsec Dialup / SAML with multiple IdPs

[ThibElie]

Hello Team,

Our customers use SSL-VPN on their FortiGate with 2 IdPs:

• one for their users (EntraID)
• one for our users (also on EntraID - different tenant)

As migration from SSL-VPN to IPSec Dialup, we will need to use those 2 IdP with IPsec.

At the moment, it does not seem to be supported in IPsec Dialup (since the ike-saml-server is directly defined on the interface).

We did a PoC with FortiAuthenticator Cloud acting as SAML Proxy (routing based on domain), it works but it is a very expensive solution just to compensate a lack of support on the FortiGate...

Are there any other workaround?
Is the support of multiple IdPs planned in future FortiOS releases?

[Harper_King]

Currently, IPsec Dialup only supports a single SAML IdP per interface, so multiple IdPs aren’t natively supported. Using FortiAuthenticator as a SAML proxy is the usual workaround, though costly. Another option is to segregate users by interface or VPN profile if feasible. You may want to raise this with Fortinet support or check release notes—there’s no public confirmation yet on multi-IdP support in future FortiOS releases.

[AEK]

I suppose one possible solution would be to use two WAN interfaces.

[ThibElie]

Yes..but not all customers have 2nd public IP available...

[ezhupa]

Hello,

As mentioned by other users, multiple IdP with IPSEC is currently not possible. No news as to when that can become available (if it will become available) is known.
One possible solution as mentioned by AEK, is having multiple WAN interfaces.

Hope this helps.

[ThibElie]

Would it be possible to do a feature request ?

Are there any place where other users could "vote" for it?

[ezhupa]

Hello

A new feature request can be made, but this also goes through your sales representative.
You would need to contact them for more information on the NFR (new feature request) process.
As far as I know, there is no "public" process in the community for users to vote on it.