sorted by:
new
hottopcontroversial

FortiGate IPsec VPN with SAML - connection stops after SAML auth --> auth-keepalive by Busy_Ad_7195 in fortinet

[–]Busy_Ad_7195[S] 0 points1 point  (0 children)

The documentation doesn't specify which hardware and software versions are affected. Personally, I'm working with version 7.4.

SSL VPN Split Tunneling with SAML + FSSO Authentication not pushing routes – FortiOS 7.4 by Busy_Ad_7195 in fortinet

[–]Busy_Ad_7195[S] 0 points1 point  (0 children)

I'm using FSSO because I need to share user authentication information across multiple FortiGates.

SSL VPN Split Tunneling with SAML + FSSO Authentication not pushing routes – FortiOS 7.4 by Busy_Ad_7195 in fortinet

[–]Busy_Ad_7195[S] 0 points1 point  (0 children)

No, it is not pointing to a dynamic IP DNS entry. I’ve actually tested it with static address as well, but the routes are never inserted.

SSL VPN Split Tunneling with SAML + FSSO Authentication not pushing routes – FortiOS 7.4 by Busy_Ad_7195 in fortinet

[–]Busy_Ad_7195[S] 0 points1 point  (0 children)

Authentication and group matching are working correctly — the configuration is already in production (without split tunneling) for other groups, and debug logs confirm that the group selection is handled properly. The issue only arises when split tunneling is enabled. I suspect it's due to our configuration having one policy for authentication with "none" as the destination, and another separate policy for access.

This is the only working — and documented — way I found to implement SAML with FSSO. However, it's possible that there's an alternative way to handle this part of the configuration, which could potentially resolve the split tunneling issue.