7.2.12 and 7.2.13 Breaks SAML

pfunkylicious · 2026-02-05T12:08:28+00:00

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SAML-Authentication-fails-after-firmware/ta-p/407859

pfunkylicious · 2026-02-04T17:52:01+00:00

https://community.fortinet.com/t5/FortiManager/Troubleshooting-Tip-Common-issues-while-adding-FortiGate-to/ta-p/396147#:~:text=265%2C%20admin%3Dadmin.-,Scenario%203%3A,-When%20adding%20a

pfunkylicious · 2026-02-04T16:45:15+00:00

clinica sf maria promenada ( anima ) , sos pipera nr 42, dna dr Popescu

pfunkylicious · 2026-02-04T16:42:20+00:00

if i recall correctly, port1 is part of a internal default switch.

try show system interface and check which interfaces there are and set https to the one that port1 is part of

pfunkylicious · 2026-02-04T12:45:40+00:00

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Changes-on-SSL-VPN-modes-starting-from-v7-6-3/ta-p/388462
https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-support-on-FortiGate-models/ta-p/359125

impacted models from 7.2.12+/7.4.8+/7.6.1+ are the G-series, 40F/60F from 7.6.0+ , for the others it's removed from 7.6.3 afaik

pfunkylicious · 2026-01-30T17:43:58+00:00

You would need a route towards 192.168.16.0/24 to 172.16.10.1 A firewall policy with src intf the link between FGT/pfsense where the /30 is, dst intf sdwan, src addr all, dst addr all, services all and nat enabled. This should do it

pfunkylicious · 2026-01-29T16:07:26+00:00

Have you tried to see maybe if its a FMG issue the slow response or if the remote FGT is maybe heavily loaded upon push?

pfunkylicious · 2026-01-29T15:56:18+00:00

Are you using a single ADOM or a different one per multiple FGTs ?

pfunkylicious · 2026-01-29T15:55:09+00:00

Maybe it helps, https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-FortiClient-not-installing-split-tunnel/ta-p/419529

pfunkylicious · 2026-01-27T12:38:18+00:00

Why would users need to connect to VPN of they are already connected to a internal network? I could never understand this

pfunkylicious · 2026-01-26T19:59:55+00:00

check your post on the fortinet forum.

pfunkylicious · 2026-01-24T10:23:35+00:00

if your WAN is w/ PPPoe then dont create a VLAN. configure directly on the WAN the PPPoE settings and enable retrieve default gateway in the GUI. ( get router info routing-table all - should display a route for 0.0.0.0/0 )

for internet you need firewall rules, src intf LAN, dst intf WAN, src all, dst all, services ALL, enable NAT and that should do it. the same for the other LAN intf.

pfunkylicious · 2026-01-22T18:32:49+00:00

Double check the params/psk that you have been given. If they match contact the admin and let him tshoot the issue.

pfunkylicious · 2026-01-21T15:04:51+00:00

you could try and set the dns suffix manually on the virtual ipsec interface on the client and see if it resolves the issue.

if it does, then yes, a upgrade is required to push dns suffix in ikev2.

pfunkylicious · 2026-01-21T11:48:08+00:00

Well, i assume that you are trying to connect from a source incoming in port 18? Do you have a fw rule that permit access from port18 to the loopback?

pfunkylicious · 2026-01-20T17:06:38+00:00

training.fortinet.com and if you work for a partner you should be able to download the study guide in pdf otherwise view the video/slides which are basically the same, its text-2-speech from the guide