This article describes how to integrate Fortinet IPsec VPN with RSA Cloud Access Service (CAS) using Relying Party. 

Configure CAS

Perform these steps to configure CAS. 

Procedure

1. Sign in to the RSA Cloud Administration Console.
2. Click Authentication Clients > Relying Parties.
   
3. Click Add a Relying Party.
4. Click Add for Service Provider SAML. 
   
5. On the Basic Information page, enter the name for the application in the Name field and click Next Step.
   
6. On the Authentication page, choose RSA manages all authentication.
7. In the 2.0 Access Policy for Authentication drop-down list, select a policy that was previously configured, and then click Next Step.
   
8. Under Data Input Method, choose Enter Manually.
9. Scroll down to the Service Provider section and provide the details in the following format:
   1. Assertion Consumer Service (ACS) URL: https://<FortiGate-Public-IP>:<Port>/remote/saml/login
   2. Service Provider Entity ID: https://<FortiGate-Public-IP>:<Port>/remote/saml/metadata/
      
10. Under the Message Protection section, choose IdP signs SAML assertions.
11. Click Download Certificate to use in the Configure FortiGate section. The certificate will be downloaded in .pem format.
    
12. Scroll down to the User Identity section and provide the following values:
    1. Identifier Type: unspecified
    2. Property: mail
       
       
13. Configure the Statement Attributes as shown in the following image.
    
    
14. Make note of the Entity ID under the Identity Provider section. You can enter any identifier in the Discriminator field. It will be appended to the Entity ID URL to ensure the Entity ID is unique to the Service Provider.
    
15. Click Save and Finish.
16. Click Publish Changes and wait for the operation to complete.
    After publishing, your application is now enabled for SSO. 

Notes

• The port may vary depending on the FortiGate configuration. To verify the configured port, access the FortiGate UI and navigate to VPN > IPsec-VPN Settings > Listen on Port.
• The Assertion Consumer Service URL and Service Provider Entity ID may include the port configured on the FortiGate. Custom ports are commonly used depending on the customer’s configuration.
• When ports are configured globally on the Fortinet side, the port number is not required in the Service Provider Entity ID URL.
• A public IP address is used, and communication takes place through the configured FortiGate VPN port.
• Some deployments may use HTTP instead of HTTPS, so make sure the values match the FortiGate configuration exactly.
• In the User Identity section, set Identifier Type to Unspecified and map it to either mail or sAMAccountName. Configure the Assertion Attribute username to return the corresponding mail or sAMAccountName value. To include group membership information in the assertion, configure an attribute named group and map it to either virtualGroups or localGroups so that the groups the user belongs to are sent to the service provider.

Configure FortiGate

Prerequisites

Before proceeding with the configuration, ensure that the following prerequisites are met:

• FortiGate Firmware
  • FortiOS must support SAML 2.0 for VPN authentication (introduced in FortiOS 6.x). However, it is recommended to use FortiOS 7.2.4, 7.4.x, or later.
• FortiClient
  • FortiClient version 7.2.4 or later should be installed on endpoint devices.
• Certificates
  • Certificate exchange between CAS and FortiGate is required to establish trust between the Identity Provider and Service Provider.

Import the CAS Certificate

1. Sign in to the FortiGate Console.
2. Navigate to System > Certificates.
3. Click + Create/Import and choose Remote Certificate in the drop-down list.
4. Import the CAS certificate downloaded during CAS configuration.

Configure SAML Single Sign-On

1. Navigate to User & Authentication > Single Sign-On.
2. Click Create New.
3. Under Service Provider Configuration, FortiGate automatically populates values in the following field: 
   • Entity ID
   • Assertion Consumer Service (ACS) URL
   • Single Logout URL
4. Under Identity Provider Configuration, fill in the fields using the information from the CAS configuration:
   1. Entity ID: Enter the Identity Provider URL copied from the CAS configuration.
   2. Single Sign-On URL: Enter the Identity Provider URL copied from the CAS configuration.
   3. Single Logout URL: Edit the URL manually to /saml-fe/logout instead of /saml-fe/sso.
   4. Certificate: Choose the one imported in the previous steps.
5. Configure the following SAML attribute mappings:
   1. Attribute used to identify users: username
   2. Attribute used to identify groups: group
      
      
6. Save the configuration.

Map the SAML Object to a User Group

Once the SAML Single Sign-On object has been created, associate it with a user group:

1. Navigate to User & Authentication > User Groups.
2. Click on Create New.
3. Enter a name for the user group.
4. Set the Type to Firewall.
5. Under Remote Groups:
   1. Click Add.
   2. Select the newly created SAML object as the Remote Server.
   3. Select Specify under Groups.
   4. Enter the exact group name configured in CAS (for example, VPN_Allowed_Users).
   5. Click OK and click Save.
      

Configure FortiClient

These steps prepare the endpoint device to initiate the IKEv2 IPsec VPN connection and launch the SAML authentication flow.

Procedure

1. Open FortiClient.
2. Navigate to Remote Access > Configure VPN.
3. Select IPsec VPN.
4. Configure the following settings:
   1. Connection Name: RSA IPsec VPN
   2. Remote Gateway: <FortiGate-Public-IP-or-FQDN>
   3. Authentication Method: Pre-Shared Key
   4. Enable Single Sign-On (SSO) for VPN Tunnel: Enabled
   5. Browser Type: External Browser or Embedded Browser
   6. SAML Port: Port configured during the initial FortiGate setup
5. Save the configuration and click Connect.
   • The browser will redirect the user to CAS for authentication.
   • Upon successful authentication, the VPN tunnel will be established, and the user will be granted access according to the configured FortiGate policies.

The configuration is complete.