Configuring FortiGate

Import the certificate

To import the FortiAuthenticator IdP certificate:

1. Go to System > Certificates, and click Import > Remote Certificate.
2. Click Upload and select your FortiAuthenticator IdP certificate.
3. Click OK.
   FortiGate will choose a name by default. You can rename the certificate for easier management with the following CLI commands:

   config vpn certificate remote

   rename <DEFAULT_CERT_NAME> to <NEW_CERT_NAME>

   end

Configure the SAML user

You can now configure a FortiGate SAML user to point to FortiAuthenticator as the IdP.

In this example configuration, the FortiGate SSL VPN link is https://203.0.113.18:10443. This can be replaced with the SSL VPN link from your own configuration.

You will also need to adjust the FortiAuthenticator IdP entity ID, login URL, and logout URL to match those configured in your FortiAuthenticator. This information is available on FortiAuthenticator in Authentication > SAML IdP > Service Providers.

Configuring the SAML user must be done through the FortiGate CLI.

To configure a SAML user:

1. In the FortiGate CLI, enter the following commands:

   config user saml

   edit "fac-samlproxy-sslvpn"

   set cert "Fortinet_Factory"

   set entity-id "https://203.0.113.18:10443/remote/saml/metadata"

   set single-sign-on-url "https://203.0.113.18:10443/remote/saml/login"

   set single-logout-url "https://203.0.113.18:10443/remote/saml/logout"

   set idp-entity-id "http://fac.fortilab.local/saml-idp/fgt1sslvpn/metadata/"

   set idp-single-sign-on-url "https://fac.fortilab.local/saml-idp/fgt1sslvpn/login/"

   set idp-single-logout-url "https://fac.fortilab.local/saml-idp/fgt1sslvpn/logout/"

   set idp-cert "FAC_IdP"

   set user-name "username"

   set group-name "groups"

   next

   end

The entity ID, single sign on URL, and single logout URL configured in the FortiGate CLI must now be entered in the FortiAuthenticator service provider configuration. See To add FortiGate as a SAML service provider:

The user-name and group-name configured must match what is being returned from FortiAuthenticator in the SAML assertions. See Configure the SAML IdP settings on FortiAuthenticator.

You can now create a SAML group which includes that user. You can also define the SAML groups that will be allowed to login as this group. In this example, only user that belong to "FGTGroup1" will be allowed to login to the SSL VPN. This can only be done through FortiGate CLI.

To configure a SAML group:

1. In the FortiGate CLI, enter the following commands:

   config user group

   edit "samlproxy-sslvpn"

   set member "fac-samlproxy-sslvpn"

   config match

   edit 1

   set server-name fac-samlproxy-sslvpn

   set group-name “FGTGroup1”

   next

   end

   next

   end

Next, increase the remote authentication timeout. This must be set to allow for enough time for the user to authenticate into Azure AD. This can only be done through the FortiGate CLI.

To increase the remote authentication timeout:

1. In the FortiGate CLI, enter the following commands:

   config system global

   set remoteauthtimeout 60

   end

Configure the SSL VPN

You can define a portal for the SAML group in your SSL VPN settings.

To add a portal to your SSL VPN:

1. Go to VPN > SSL-VPN Settings, and edit your SSL VPN configuration.
2. Under Authentication/Portal Mapping, click Create New.
3. Configure the following information:
   1. Users/Groups: Select the configured user group.
   2. Portal: full-access.
4. Click OK and save your changes to the SSL VPN settings.
5. Configure your SSL VPN rules as required.
   

For more information on configuring SSL VPN on FortiGate, see the FortiGate Administration Guide.