# Fortinet

> Protect FortiGate VPN with Ironchip: SSL VPN with SAML or RADIUS and NPS, and a remote access IPsec tunnel with SAML, tested with FortiClient.

URL: https://docs.ironchip.com/en/identidad/integraciones/red/fortinet/

This guide explains the ways to integrate **Fortinet** (FortiGate) with Ironchip: SSL VPN with [SAML](https://docs.ironchip.com/en/identidad/protocolos/saml/), SSL VPN with [RADIUS](https://docs.ironchip.com/en/identidad/protocolos/radius/) through [NPS](https://docs.ironchip.com/en/identidad/integraciones/red/nps/), and remote access IPsec with SAML.

## SSL VPN with SAML

Integrate the FortiGate SSL VPN with Ironchip authentication through SAML.

### Requirements

- Access to the Ironchip admin console.
- A user with permissions to make changes in Fortinet.

### Configure Ironchip

1. In the Ironchip admin console, go to **Applications** and click the green **New application** button.

   [Image: New application button in Applications]

2. Select the **SAML** type and download the metadata with **Download metadata file**. You use it in the next steps.

   [Image: Selecting the SAML type and downloading the metadata]

You come back to this application later to finish the configuration.

### Configure FortiGate

1. In the FortiGate admin interface, go to **User & Authentication > Single Sign-On** and click **Create New**, at the top left.

   [Image: Create New button in Single Sign-On]

2. Set these parameters, all of them required:

   - **Name**: a descriptive name.
   - **Address**, under **Service Provider Configuration**: the public IP address the authentication request is sent to. It is usually the same IP as the VPN.
   - **Entity ID**, **Assertion consumer service URL** and **Single logout service URL**: the URLs Ironchip uses to communicate with Fortinet.
   - **Certificate**: the Fortinet certificate to use.

   [Image: First SSO configuration screen in FortiGate]

3. Click **Next**. The second section is edited with commands: click **Edit in CLI**.

   [Image: Edit in CLI button]

4. In the console that opens, run these commands and replace `<VPN IP>` with the IP of your VPN:

   ```text
   set entity-id "https://<VPN IP>/remote/saml/metadata/"
   set single-sign-on-url "https://<VPN IP>/remote/saml/login"
   set single-logout-url "https://<VPN IP>/remote/saml/logout"
   end
   ```

5. Close the terminal and click **Cancel**. This prevents the default values from being restored.

### Back to Ironchip: FortiGate metadata

In the Ironchip application you must enter the metadata URL it uses to communicate with Fortinet.

1. Open a terminal in Fortinet and run:

   ```text
   diag vpn ssl saml-metadata "<SAML NAME HERE>"
   ```

2. Upload the output to a public internet address and copy its raw URL.
3. Paste that URL into the **Metadata URL** field of the Ironchip application.

   [Image: Metadata URL field of the SAML application in Ironchip]

4. Click **Add service** to finish the configuration in Ironchip.

:::note
In the current version of the console, the SAML application has the **Service Provider (SP)** section with the **SP Metadata** field, which accepts **URL**, **Text** and **File**. Select **Text**, paste the command output and click **Import**, as in [IPsec with SAML](#ipsec-with-saml): you do not need to upload it to a public address.
:::

### Finish the FortiGate configuration

Go back to the Fortinet screen where you left off. Keep the metadata file you downloaded from Ironchip open.

1. In **Type**, select `Custom`.
2. Fill in the IdP URLs with the data from the metadata file:

   - **EntityID**: the `entityID` property of the `EntityDescriptor` XML tag.
   - **Assertion consumer service URL**: the `Location` property of the `SingleSignOnService` XML tag.
   - **Single logout service URL**: the `Location` property of the `SingleLogoutService` XML tag.
   - **Certificate**: create a file with the `.crt` extension and paste into it the output of entering the content of the `X509Certificate` XML tag from the metadata file in the first field of [SAML Tool](https://www.samltool.com/format_x509cert.php). Both certificates are identical.

3. Enter the attributes:

   - **Attribute used to identify users**: `urn:oid:0.9.2342.19200300.100.1.1`
   - **Attribute used to identify groups**: `urn:oid:1.3.6.1.4.1.5923.1.1.1.1`

   [Image: IdP details and attributes configuration in FortiGate]

4. Click **Submit** to save the configuration.

### Additional configuration

1. Create a group that has the Fortinet SSO configuration as a member.

   [Image: User group with the SSO configuration as a member]

2. Add the group to the SSL VPN configuration, in **Authentication/Portal Mapping**.

   [Image: Group added in Authentication/Portal Mapping]

3. Add the group to the VPN policy, in the **Source** section.

   [Image: Group added in the Source field of the VPN policy]

4. Configure the authentication timeouts. Open a Fortinet terminal with the icon in the upper right corner and run these commands, which give the users of the associated group 60 seconds to authenticate:

   ```text
   config user group
   edit <PROTECTED_USER_GROUP_NAME>
   set authtimeout 60
   end
   ```

   ```text
   config system global
   set remoteauthtimeout 60
   end
   ```

### SAML and password authentication at the same time (optional)

For users to be able to sign in both with SAML and with a local password, choose one of these options.

**Option 1.** Add the local users to the group you created earlier.

[Image: Local users added to the SAML group]

**Option 2.** Create a new group with the local users.

[Image: New group with the local users]

Then add that group to **SSL-VPN Settings** and to the policy you created earlier.

[Image: Local group added to SSL-VPN Settings]

[Image: Local group added to the VPN policy]

## SSL VPN with RADIUS

Set up the RADIUS service in Fortinet and integrate it with an NPS server in an Active Directory environment.

### Requirements

- A working Active Directory.
- The NPS role installed on a Windows Server and protected by Ironchip. See [Microsoft NPS](https://docs.ironchip.com/en/identidad/integraciones/red/nps/).
- An MFA application created in the Ironchip admin console.
- The Ironchip app downloaded.

### Configure NPS

1. On your AD server, open the NPS (Network Policy Server) configuration and create a new RADIUS client that points to the Fortinet IP.

   [Image: Creating a RADIUS client in NPS]

2. Enter these details:

   - A descriptive name for RADIUS.
   - The IP of Fortinet.
   - A secret key for RADIUS.

   [Image: RADIUS client details: name, IP and secret]

### Users and groups in FortiGate

1. Open the Fortinet configuration panel in a browser, using the IP of your Fortinet device.

   [Image: FortiGate admin panel login screen]

2. Go to **User & Authentication > RADIUS Servers** and add a new one.

   [Image: User & Authentication > RADIUS Servers menu]

3. Fill in the details: a descriptive name, the IP of the server where you created RADIUS, and the RADIUS secret.

   [Image: RADIUS server form in FortiGate]

4. To confirm that it connected correctly, click **Test Connectivity**. If the result is `Successful`, click **Test User Credentials** and sign in with a user from your domain. If it fails, check that the Windows Server firewall has an inbound rule that allows RADIUS (UDP) traffic from the Fortinet IP.
5. Create a group and users that refer to the domain in Fortinet. Go to **User & Authentication > User Groups** and add a new one.

   [Image: User & Authentication > User Groups menu]

6. Give it a name, select **Firewall** and in **Remote groups** select your RADIUS server.

   [Image: User group form with the remote RADIUS server]

7. To configure the users, go to the **User Definition** tab and repeat these steps for each user:

   1. Click **Create New**.
   2. Select **Remote RADIUS User**.
   3. Enter the user in `domain\username` format and select the RADIUS server you created earlier.
   4. Leave **Two-factor** disabled.
   5. Enable **User Group** and select the group you created.

Video: [Creating remote RADIUS users in FortiGate](https://play.hubspotvideo.com/v/7745202/id/147404703799)

#### Attribute in the network policy (optional)

To avoid creating the users one by one, add an attribute to the domain network policy.

1. Open **Network Policy Server**.

   [Image: Network Policy Server window]

2. Go to **Policies > Network Policies** and double-click the policy.

   [Image: List of network policies]

   [Image: Network policy properties]

3. Go to **Settings**, under **RADIUS Attributes** select **Vendor Specific** and click **Add**.

   [Image: Vendor-specific RADIUS attributes]

4. In the **Vendor** drop-down, select **Custom** and then the `vendor-specific` option.

   [Image: Selecting the custom vendor]

5. Click **Add**. This window appears:

   [Image: Vendor-specific attribute information window]

6. Click **Add** and set the next window as shown:

   [Image: Vendor identifier configuration]

7. Click **Configure Attribute** and in the window that appears set:

   1. **Vendor-assigned attribute number**: `1`.
   2. **Attribute format**: `String`.
   3. **Attribute value**: the group you created earlier in Fortinet.

   [Image: Attribute configuration with number 1, string format and the group]

### Configure the VPN

1. Go to **VPN > SSL-VPN Settings**.

   [Image: VPN > SSL-VPN Settings menu]

2. Modify the fields as follows:

   - Select the interfaces you will use, such as the WAN or LAN.
   - Change the port to avoid conflicts. We recommend `4443` or `10443`.
   - You do not need to create a certificate, but you can create a self-signed one if you need it.

3. Scroll to the bottom of the page, where there are two more fields to configure.

   [Image: Final fields of SSL-VPN Settings: portal mapping]

4. In **Authentication/Portal Mapping**, click **Create New**, select your user group and assign it the `tunnel-access` portal.
5. Click **Apply**.

### Firewall policy

1. Go to **Policy & Objects > Firewall Policy** and create a new policy.

   [Image: Firewall Policy screen]

2. Configure it as follows:

   - **Name**: a name for the policy. It is the one you enter in the application in the Ironchip console and in the plugin.
   - **Incoming Interface**: `SSL-VPN tunnel interface`.
   - **Outgoing Interface**: the physical interface.
   - **Source**: `all` and, very important, the group you created.
   - **Destination**: `all`.
   - **Service**: `ALL`.

3. Click **OK**.
4. Set the Fortinet and RADIUS connection timeouts to 60 seconds so users have time to complete authentication. Open a Fortinet terminal with the icon in the upper right corner. This command gives the users of the associated group 60 seconds:

   ```text
   config user group
   edit <PROTECTED_USER_GROUP_NAME>
   set authtimeout 60
   end
   ```

5. Do the same for the RADIUS connection:

   ```text
   config system global
   set remoteauthtimeout 60
   end
   ```

6. Change the configuration so that Fortinet does not send more than one request when you authenticate:

   ```text
   config user radius
   edit <RADIUS_SERVER_NAME_IN_FORTIGATE>
   set timeout 60
   end
   ```

### Application in Ironchip

Video: [Creating the Fortinet application in the Ironchip admin console](https://play.hubspotvideo.com/v/7745202/id/147399189058)

### Verify with FortiClient

Both the NPS server and Fortinet must be running when you test.

1. In FortiClient, select **REMOTE ACCESS**.

   [Image: Remote Access option in FortiClient]

2. In the next window, select **Configure VPN**.

   [Image: Configure VPN option]

3. Enter the VPN details. Use the same user identification pattern that you set in the group and in the application in the Ironchip console. Click **Save**.

   [Image: VPN configuration form in FortiClient]

4. The next screen shows the connection name and the username. Enter the password and click **Connect**. If the computer firewall blocks the connection, create a rule that allows FortiClient to connect to the VPN IP and port instead of disabling the firewall.

   [Image: Connection screen with username and password]

5. A security alert appears. Read it and click **Yes**.

   [Image: Security alert when connecting]

6. The connection process continues. You receive a message to authorize access from the Ironchip app. When you accept it, the connection completes.
7. When the connection is established, a window with a brief description appears.

   [Image: Established VPN connection window]

Video: [Demo: Fortinet VPN access with Ironchip](https://play.hubspotvideo.com/v/7745202/id/147405821357)

## IPsec with SAML

Protect a remote access IPsec VPN tunnel (dial-up, IKEv2) on FortiGate with SAML authentication through Ironchip.

### Requirements

- Administrative access to the FortiGate GUI and CLI.
- An administrator account in the Ironchip console with permissions to create SAML applications.
- **FortiClient VPN** installed on the client computers, with SSO/SAML support for IPsec.
- A remote access IPsec VPN (IKEv2).

### Enable the global SAML port

From the Fortinet CLI, run:

```text
config system global
    set auth-ike-saml-port 1001
end
```

### Configure the SAML application

Configure SAML SSO in Fortinet and in Ironchip.

1. In FortiGate, go to **User & Authentication > Single Sign-On** and click **Create New**.

   [Image: Create New button in Single Sign-On]

2. Enter a name for the configuration, the IP or DNS name of the VPN together with the SAML port you configured earlier, and the certificate you use in the VPN.

   [Image: Service provider details: name, address, SAML port and certificate]

3. The next window asks for the identity provider (IdP) metadata, in this case Ironchip. To get it, go to the Ironchip admin console > **Applications > New application > SAML**.

   [Image: Applications menu and New application button]

   [Image: Selecting the SAML type]

4. When you create the application, it asks for a name. Use a descriptive one, because it appears later on the users' authenticator devices.

   [Image: SAML application name in Ironchip]

5. Go to the **Identity Provider (IdP)** section and copy this data:

   - **IdP Entity ID or Issuer**
   - **Single Sign On Service (URL)**
   - **Signing X.509 Certificate**. You must import this certificate into Fortinet.

   [Image: Identity Provider data in Ironchip]

6. Paste the data into the Fortinet configuration:

   - **IdP Entity ID or Issuer** in **Entity ID**.
   - **Single Sign On Service** in **Assertion consumer service URL**.
   - **Single logout service URL**: use the same URL as **Assertion consumer service URL**, but change `sso` to `slo` in the path.

7. Enter the attributes Fortinet asks for to authenticate users:

   - **Attribute used to identify users**: `urn:oid:0.9.2342.19200300.100.1.1`
   - **Attribute used to identify groups**: `urn:oid:1.3.6.1.4.1.5923.1.1.1.1`

   [Image: User and group attributes in the FortiGate SAML configuration]

8. Get the Fortinet metadata to import it into Ironchip. Open the Fortinet global CLI and run:

   ```text
   diag vpn ssl saml-metadata "<SAML NAME HERE>"
   ```

9. Copy the output. In the application you created in the Ironchip admin console, open the **Service Provider (SP)** section, select **Text** in **SP Metadata**, paste the output and click **Import**.

   [Image: SP Metadata field in the Service Provider section]

10. Click **Add** to finish creating the application in Ironchip.

### Create the user group

Assign this SAML configuration to a group so you can later associate it with the firewall policies.

[Image: Creating the user group with the SAML configuration]

[Image: User group created]

### Enable EAP on the phase 1 interface

Edit the phase 1 interface to replace PSK with EAP against the Ironchip user group:

```text
config vpn ipsec phase1-interface
    edit IPSEC-DIALUP
        set eap enable
        set eap-identity send-request
        set authusrgrp SAML-Group
end
```

:::note
To apply authentication to several groups instead of just one, leave `authusrgrp` with empty quotes: `set authusrgrp ""`.
:::