164 lines
4.3 KiB
Markdown
164 lines
4.3 KiB
Markdown
|
||
# FortiGate 100F Cluster – IPsec VPN met Entra ID (SSO via SAML)
|
||
|
||
## 🧩 Overzicht
|
||
Gebruikers verbinden via IPsec VPN naar het FortiGate-cluster met hun Entra ID-account.
|
||
De FortiGate vertrouwt op Entra ID als *SAML Identity Provider (IdP)*.
|
||
De FortiClient VPN app gebruikt SAML-authenticatie en ontvangt dynamisch de aanmeld-URL.
|
||
|
||
---
|
||
|
||
## 1️⃣ Entra ID – App registratie
|
||
|
||
1. Meld aan bij [https://entra.microsoft.com](https://entra.microsoft.com)
|
||
2. Ga naar **Applications > App registrations > New registration**
|
||
- **Name:** `FortiGate VPN SSO`
|
||
- **Supported account types:** Single tenant
|
||
- **Redirect URI (Web):**
|
||
```
|
||
https://<fortigate-fqdn>:443/saml/sp/acs
|
||
```
|
||
3. Klik **Register**
|
||
|
||
### 1.1 SAML instellingen
|
||
1. Open de nieuwe app → **Single sign-on** → kies **SAML**
|
||
2. Bij **Basic SAML Configuration:**
|
||
- **Identifier (Entity ID):** `https://<fortigate-fqdn>/saml/sp`
|
||
- **Reply URL (ACS URL):** `https://<fortigate-fqdn>:443/saml/sp/acs`
|
||
- **Sign on URL:** `https://<fortigate-fqdn>`
|
||
3. **User Attributes & Claims:** laat standaard (“user.userprincipalname”)
|
||
4. **SAML Signing Certificate:** download **Federation Metadata XML**
|
||
|
||
### 1.2 Toegang & gebruikers
|
||
Voeg onder **Enterprise Applications > Users and groups** de groep(en) of gebruiker(s) toe die mogen inloggen.
|
||
|
||
---
|
||
|
||
## 2️⃣ FortiGate – SAML IdP configureren
|
||
|
||
Upload het metadata-bestand en maak de IdP-entry aan:
|
||
|
||
```bash
|
||
config user saml
|
||
edit "entra-sso"
|
||
set cert "Fortinet_Factory"
|
||
set entity-id "https://<fortigate-fqdn>/saml/sp"
|
||
set single-sign-on-url "https://<fortigate-fqdn>:443/saml/sp/acs"
|
||
set idp-entity-id "https://sts.windows.net/<tenant-id>/"
|
||
set idp-single-sign-on-url "https://login.microsoftonline.com/<tenant-id>/saml2"
|
||
set idp-cert "azuread-sso.crt"
|
||
set user-name "userprincipalname"
|
||
next
|
||
end
|
||
```
|
||
|
||
💡 **azuread-sso.crt** importeer je onder *System → Certificates → Import → Remote CA Certificate* (uit het metadata-XML van Entra ID).
|
||
|
||
Controleer met:
|
||
```bash
|
||
show user saml
|
||
```
|
||
|
||
---
|
||
|
||
## 3️⃣ IPsec-tunnel aanmaken (Phase 1 + 2)
|
||
|
||
**GUI → VPN → IPsec Tunnels → Create New → Custom.**
|
||
|
||
### Phase 1
|
||
| Instelling | Waarde |
|
||
|-------------|---------|
|
||
| **Name** | vpn-entra |
|
||
| **Remote Gateway** | Dynamic IP Address |
|
||
| **Interface** | WAN1 |
|
||
| **Authentication Method** | SAML User |
|
||
| **SAML Server** | entra-sso |
|
||
| **Mode** | Aggressive |
|
||
| **IKE Version** | v2 |
|
||
| **Proposal** | AES256/SHA256/DH14 |
|
||
| **DPD/Keepalive** | standaard |
|
||
|
||
### Phase 2
|
||
| Instelling | Waarde |
|
||
|-------------|---------|
|
||
| **Name** | vpn-entra-p2 |
|
||
| **Phase1 Interface** | vpn-entra |
|
||
| **Local Address** | 0.0.0.0/0 |
|
||
| **Remote Address** | 0.0.0.0/0 |
|
||
| **Proposal** | AES256/SHA256 |
|
||
|
||
---
|
||
|
||
## 4️⃣ Firewall user-groep koppelen
|
||
|
||
```bash
|
||
config user group
|
||
edit "vpn-entra-group"
|
||
set member "entra-sso"
|
||
next
|
||
end
|
||
```
|
||
|
||
---
|
||
|
||
## 5️⃣ Policy voor VPN-verkeer
|
||
|
||
```bash
|
||
config firewall policy
|
||
edit 0
|
||
set name "VPN_to_LAN"
|
||
set srcintf "vpn-entra"
|
||
set dstintf "lan"
|
||
set srcaddr "all"
|
||
set dstaddr "all"
|
||
set action accept
|
||
set schedule always
|
||
set service ALL
|
||
set nat enable
|
||
set groups "vpn-entra-group"
|
||
next
|
||
end
|
||
```
|
||
|
||
---
|
||
|
||
## 6️⃣ FortiClient VPN instellen
|
||
|
||
FortiClient (VPN-only versie 7.4+) → **Remote Access → IPsec VPN → Add New**
|
||
|
||
| Veld | Waarde |
|
||
|------|---------|
|
||
| **Connection Name** | FortiGate SSO VPN |
|
||
| **VPN Type** | IPsec |
|
||
| **Remote Gateway** | `https://<fortigate-fqdn>` |
|
||
| **Authentication** | SSO with SAML |
|
||
| **Username/Password** | Leeg laten |
|
||
| **Group Name (ID)** | vpn-entra (optioneel) |
|
||
|
||
Test → je wordt doorgestuurd naar Microsoft login.microsoftonline.com.
|
||
|
||
---
|
||
|
||
## 7️⃣ Test & troubleshoot
|
||
|
||
- Controleer aanmeld-URL:
|
||
`https://<fortigate-fqdn>:443/saml/sp/test`
|
||
- FortiGate CLI-debug:
|
||
```bash
|
||
diagnose debug enable
|
||
diagnose debug application ike -1
|
||
```
|
||
- Controleer dat “SAML assertion” wordt ontvangen na login.
|
||
|
||
---
|
||
|
||
## ✅ Resultaat
|
||
|
||
Na succesvolle Entra-ID-authenticatie krijgt de gebruiker een IPsec-tunnel met policy-gebaseerde toegang.
|
||
Aanpassing van toegangsrechten doe je in Entra ID via groepslidmaatschap.
|
||
|
||
---
|
||
|
||
© 2025 Screen GP Europe – ICT Dept.
|
||
Documentversie: 1.0 – Auteur: Marco Voskuil
|