Struggling to get FortiGate IPsec + SAML (Azure Entra ID) working — Phase 1 OK, SAML auth not comple

[avring]

Hi everyone,

I’ve been fighting with this setup for the last two days and could really use some expert eyes.
I’m trying to deploy a FortiGate IPsec VPN using SAML (Azure Entra ID) for FortiClient connections — to replace our old SSL VPN.

The tunnel initiates fine, NAT-T is detected, and Phase 1 completes with a valid proposal.
But after that, I only see this in the debug logs — no actual user name, just a FortiClient UID block:

ike V=root:0:FCT_SAML:6005: received FCT data len = 290, data = 'VER=1 FCTVER=7.4.3.1790 UID=[REDACTED_CLIENT_UID] IP=[REDACTED_PRIVATE_IP] MAC=[REDACTED_MAC_ADDRESSES] HOST=[REDACTED_HOSTNAME] USER=[REDACTED_CLIENT_UID] OSVER=Microsoft Windows 11 Enterprise Edition, 64-bit (build 26100) REG_STATUS=0 '

SAML itself is configured and reachable:

set entity-id "https://remote.exampledomain.pt:4448/remote/saml/metadata/" set single-sign-on-url "https://remote.exampledomain.pt:4448/remote/saml/login" set single-logout-url "https://remote.exampledomain.pt:4448/remote/saml/logout" set idp-entity-id "https://sts.windows.net/[tenant-id]/" set idp-single-sign-on-url "https://login.microsoftonline.com/[tenant-id]/saml2" set idp-cert "[certname]" set adfs-claim enable set user-claim-type upn set group-claim-type group

Azure claims are:

• Unique User ID (NameID): user.userprincipalname
• group: user.groups
• username: user.userprincipalname

What works

Phase 1 negotiation
NAT-T detection
Certificate chain (Sectigo wildcard)
SAML redirect reachable via browser

What doesn’t

FortiClient never shows the SAML login page
Debug log never shows a UPN or group — only the UID in FortiClient telemetry
Authentication never completes (no EAP_SUCCESS or assigned IP)

What I’ve tried

• Rebuilt SAML object twice
• Matched claim names (upn, group) per docs
• Tested with and without ADFS claim mode
• Checked UDP 500/4500 flow — confirmed
• Verified wildcard cert chain

At this point I suspect the SAML → EAP handoff or FortiClient side isn’t getting the redirect properly.

Any ideas or working examples for IPsec + SAML (Azure Entra) setups would be greatly appreciated.
I’ve seen very little real-world documentation on this.

Thanks in advance —
Andy

here is the whole debug file:|

Debug messages will be on for 22 minutes.

FGT # ike V=root:0: comes [REDACTED_PUBLIC_IP_1]:55165->[REDACTED_PUBLIC_IP_FG]:500,ifindex=38,vrf=0,len=392....
ike V=root:0: IKEv2 exchange=SA_INIT id=78629a0f5f3f164f/0000000000000000 len=392
ike V=root:0:78629a0f5f3f164f/0000000000000000:6002: responder received SA_INIT msg
ike V=root:0:78629a0f5f3f164f/0000000000000000:6002: incoming proposal:
ike V=root:0:78629a0f5f3f164f/0000000000000000:6002: protocol = IKEv2
ike V=root:0:78629a0f5f3f164f/0000000000000000:6002: encapsulation = IKEv2/none
ike V=root:0:78629a0f5f3f164f/0000000000000000:6002: type=ENCR, val=AES_CBC (key_len = 128)
...
ike V=root:78629a0f5f3f164f/0000000000000000 Negotiate SA Error: peer SA proposal not match local policy
ike V=root:0:78629a0f5f3f164f/0000000000000000:6002: no proposal chosen, send error response
ike V=root:0:78629a0f5f3f164f/0000000000000000:6002: sent IKE msg (NO_PROPOSAL_CHOSEN): [REDACTED_PUBLIC_IP_FG]:500->[REDACTED_PUBLIC_IP_1]:55165

--- next attempt (valid FortiClient) ---

ike V=root:0: comes [REDACTED_PUBLIC_IP_2]:51830->[REDACTED_PUBLIC_IP_FG]:500,ifindex=38,vrf=0,len=369....
ike V=root:0: IKEv2 exchange=SA_INIT id=d2b28657b69dc6c5/0000000000000000 len=369
ike V=root:0:d2b28657b69dc6c5/0000000000000000:6005: responder received SA_INIT msg
ike V=root:0:d2b28657b69dc6c5/0000000000000000:6005: matched proposal id 1
ike V=root:0:d2b28657b69dc6c5/0000000000000000:6005: SA proposal chosen, matched gateway FCT_SAML
ike V=root:0:FCT_SAML:FCT_SAML: created connection: 0x2b55e13de1e0 38 [REDACTED_PUBLIC_IP_FG]->[REDACTED_PUBLIC_IP_2]:51830
ike V=root:0:FCT_SAML:6005: NAT detected: PEER
ike V=root:0:FCT_SAML:6005: IKE SA established
ike V=root:0:FCT_SAML:6005: responder preparing AUTH msg

--- SAML + FortiClient telemetry exchange ---

ike V=root:0:FCT_SAML:6005: received FCT data len = 290
data = 'VER=1
FCTVER=7.4.3.1790
UID=[REDACTED_CLIENT_UID]
IP=[REDACTED_PRIVATE_IP]
MAC=[REDACTED_MAC_ADDRESSES]
HOST=[REDACTED_HOSTNAME]
USER=[REDACTED_CLIENT_UID]
OSVER=Microsoft Windows 11 Enterprise Edition, 64-bit (build 26100)
REG_STATUS=0
'

ike V=root:0:FCT_SAML:6005: peer identifier IPV4_ADDR [REDACTED_PRIVATE_IP]
ike V=root:0:FCT_SAML:6005: responder preparing EAP identity request
ike V=root:0:FCT_SAML:6005: local cert subject='*.exampledomain.pt'
ike V=root:0:FCT_SAML:6005: issuer='Sectigo RSA Domain Validation Secure Server CA'

[funkylicious]

hi,

can you share a sanitized config for phase1/2 for the ipsec and also for user saml with all the info ?