FORTIGATE - SAML Debug: Difference between revisions
From IT-Arts.net
No edit summary |
No edit summary |
||
| Line 9: | Line 9: | ||
Enable timestamps before collecting any debug output to simplify correlation with client and identity provider logs. | Enable timestamps before collecting any debug output to simplify correlation with client and identity provider logs. | ||
<nowiki> | <nowiki> | ||
diagnose debug console timestamp enable | diagnose debug console timestamp enable | ||
diagnose debug reset | diagnose debug reset | ||
| Line 20: | Line 20: | ||
Always disable debugging after troubleshooting to avoid unnecessary CPU usage and excessive log generation. | Always disable debugging after troubleshooting to avoid unnecessary CPU usage and excessive log generation. | ||
<nowiki> | <nowiki> | ||
diagnose debug disable | diagnose debug disable | ||
diagnose debug reset</nowiki> | diagnose debug reset</nowiki> | ||
| Line 28: | Line 28: | ||
Check that SAML daemon is actually processing authentication requests. | Check that SAML daemon is actually processing authentication requests. | ||
<nowiki> | <nowiki> | ||
diagnose sys process pidof samld | diagnose sys process pidof samld | ||
diagnose sys top</nowiki> | diagnose sys top</nowiki> | ||
| Line 36: | Line 36: | ||
=== Display current SAML sessions === | === Display current SAML sessions === | ||
<nowiki> | <nowiki> | ||
diagnose vpn ssl saml-session list</nowiki> | diagnose vpn ssl saml-session list</nowiki> | ||
Example: | Example: | ||
<nowiki> | <nowiki> | ||
Session ID : 9 | Session ID : 9 | ||
User : john.doe | User : john.doe | ||
| Line 51: | Line 51: | ||
=== Display authenticated users === | === Display authenticated users === | ||
<nowiki> | <nowiki> | ||
diagnose firewall auth list</nowiki> | diagnose firewall auth list</nowiki> | ||
=== Display session table === | === Display session table === | ||
<nowiki> | <nowiki> | ||
diagnose sys session list</nowiki> | diagnose sys session list</nowiki> | ||
| Line 63: | Line 63: | ||
=== Enable SSL VPN debug === | === Enable SSL VPN debug === | ||
<nowiki> | <nowiki> | ||
diagnose debug application sslvpn -1 | diagnose debug application sslvpn -1 | ||
diagnose debug enable</nowiki> | diagnose debug enable</nowiki> | ||
| Line 69: | Line 69: | ||
=== View SSL VPN sessions === | === View SSL VPN sessions === | ||
<nowiki> | <nowiki> | ||
get vpn ssl monitor</nowiki> | get vpn ssl monitor</nowiki> | ||
=== SSL VPN configuration check === | === SSL VPN configuration check === | ||
<nowiki> | <nowiki> | ||
show vpn ssl settings</nowiki> | show vpn ssl settings</nowiki> | ||
| Line 85: | Line 85: | ||
Authentication is handled by fnbamd (same as SAML group mapping logic). | Authentication is handled by fnbamd (same as SAML group mapping logic). | ||
<nowiki> | <nowiki> | ||
diagnose debug application fnbamd -1 | diagnose debug application fnbamd -1 | ||
diagnose debug application ike -1 | diagnose debug application ike -1 | ||
| Line 92: | Line 92: | ||
=== IPsec tunnel negotiation debugging === | === IPsec tunnel negotiation debugging === | ||
<nowiki> | <nowiki> | ||
diagnose debug application ike -1 | diagnose debug application ike -1 | ||
diagnose vpn ike gateway list | diagnose vpn ike gateway list | ||
| Line 99: | Line 99: | ||
=== Live IKE negotiation trace === | === Live IKE negotiation trace === | ||
<nowiki> | <nowiki> | ||
diagnose debug console timestamp enable | diagnose debug console timestamp enable | ||
diagnose debug reset | diagnose debug reset | ||
| Line 107: | Line 107: | ||
Filter by peer IP: | Filter by peer IP: | ||
<nowiki> | <nowiki> | ||
diagnose vpn ike log-filter addr <peer_ip></nowiki> | diagnose vpn ike log-filter addr <peer_ip></nowiki> | ||
Stop debug: | Stop debug: | ||
<nowiki> | <nowiki> | ||
diagnose debug disable | diagnose debug disable | ||
diagnose debug reset</nowiki> | diagnose debug reset</nowiki> | ||
| Line 134: | Line 134: | ||
== Web authentication (shared backend) == | == Web authentication (shared backend) == | ||
<nowiki> | <nowiki> | ||
diagnose debug application fnbamd -1 | diagnose debug application fnbamd -1 | ||
diagnose debug enable</nowiki> | diagnose debug enable</nowiki> | ||
| Line 146: | Line 146: | ||
== Certificates validation == | == Certificates validation == | ||
<nowiki> | <nowiki> | ||
show full-configuration vpn certificate local | show full-configuration vpn certificate local | ||
show full-configuration vpn certificate ca</nowiki> | show full-configuration vpn certificate ca</nowiki> | ||
| Line 152: | Line 152: | ||
== Time synchronization (critical for SAML) == | == Time synchronization (critical for SAML) == | ||
<nowiki> | <nowiki> | ||
get system status | get system status | ||
diagnose sys ntp status</nowiki> | diagnose sys ntp status</nowiki> | ||
| Line 160: | Line 160: | ||
=== SAML / HTTPS === | === SAML / HTTPS === | ||
<nowiki> | <nowiki> | ||
diagnose sniffer packet any "host <idp_ip>" 4 0 a</nowiki> | diagnose sniffer packet any "host <idp_ip>" 4 0 a</nowiki> | ||
=== IPsec IKE === | === IPsec IKE === | ||
<nowiki> | <nowiki> | ||
diagnose sniffer packet any "udp port 500 or udp port 4500" 4 0 a</nowiki> | diagnose sniffer packet any "udp port 500 or udp port 4500" 4 0 a</nowiki> | ||
== Flow debugging (authentication path) == | == Flow debugging (authentication path) == | ||
<nowiki> | <nowiki> | ||
diagnose debug reset | diagnose debug reset | ||
diagnose debug flow filter clear | diagnose debug flow filter clear | ||
| Line 179: | Line 179: | ||
Filter: | Filter: | ||
<nowiki> | <nowiki> | ||
diagnose debug flow filter addr <client_ip></nowiki> | diagnose debug flow filter addr <client_ip></nowiki> | ||
Stop: | Stop: | ||
<nowiki> | <nowiki> | ||
diagnose debug disable | diagnose debug disable | ||
diagnose debug reset</nowiki> | diagnose debug reset</nowiki> | ||
Revision as of 06:24, 6 July 2026
Debug SAML Authentication
Enable timestamped debugging
Enable timestamps before collecting any debug output to simplify correlation with client and identity provider logs.
diagnose debug console timestamp enable diagnose debug reset diagnose debug application samld -1 diagnose debug application fnbamd -1 diagnose debug enable
Disable debugging
Always disable debugging after troubleshooting to avoid unnecessary CPU usage and excessive log generation.
diagnose debug disable diagnose debug reset
Verify SAML daemon activity
Check that SAML daemon is actually processing authentication requests.
diagnose sys process pidof samld diagnose sys top
SAML Runtime Information
Display current SAML sessions
diagnose vpn ssl saml-session list
Example:
Session ID : 9 User : john.doe Group : VPN_Users Portal : full-access IdP : AzureAD Login time : 2026-07-04 09:54:13
Display authenticated users
diagnose firewall auth list
Display session table
diagnose sys session list
SSL VPN Debugging (SAML + non-SAML)
Enable SSL VPN debug
diagnose debug application sslvpn -1 diagnose debug enable
View SSL VPN sessions
get vpn ssl monitor
SSL VPN configuration check
show vpn ssl settings
IPsec SAML / authentication context (important)
SAML is typically used for SSL-VPN, but in IPsec environments authentication depends on mode:
IPsec with username/password (FNBAMD path)
Authentication is handled by fnbamd (same as SAML group mapping logic).
diagnose debug application fnbamd -1 diagnose debug application ike -1 diagnose debug enable
IPsec tunnel negotiation debugging
diagnose debug application ike -1 diagnose vpn ike gateway list diagnose vpn tunnel list
Live IKE negotiation trace
diagnose debug console timestamp enable diagnose debug reset diagnose debug application ike -1 diagnose debug enable
Filter by peer IP:
diagnose vpn ike log-filter addr <peer_ip>
Stop debug:
diagnose debug disable diagnose debug reset
IPsec + SAML reality check
SAML is NOT directly used in classic IPsec tunnels.
Instead:
- SSL-VPN → SAML supported natively
- IPsec dialup → usually LDAP/RADIUS or local users
- IPsec + external auth → goes through fnbamd, not samld
So when troubleshooting IPsec login issues, focus on:
- ike daemon
- fnbamd daemon
- user/group mapping
Web authentication (shared backend)
diagnose debug application fnbamd -1 diagnose debug enable
Useful for:
- SAML group mapping
- LDAP / RADIUS fallback
- user identity resolution
Certificates validation
show full-configuration vpn certificate local show full-configuration vpn certificate ca
Time synchronization (critical for SAML)
get system status diagnose sys ntp status
Packet capture (SAML / IPsec)
SAML / HTTPS
diagnose sniffer packet any "host <idp_ip>" 4 0 a
IPsec IKE
diagnose sniffer packet any "udp port 500 or udp port 4500" 4 0 a
Flow debugging (authentication path)
diagnose debug reset diagnose debug flow filter clear diagnose debug flow show function-name enable diagnose debug flow trace start 100 diagnose debug enable
Filter:
diagnose debug flow filter addr <client_ip>
Stop:
diagnose debug disable diagnose debug reset
Common failures
SAML login loop
- wrong ACS URL
- cookie blocked
- time drift
- wrong entity-id
IPsec authentication fails
- wrong group mapping
- fnbamd rejection
- phase1 mismatch
- PSK mismatch (non-SAML case)
SAML works but no VPN access
- firewall policy missing
- group not mapped
- portal mismatch
No debug output
- forgot enable
- wrong daemon targeted
- authentication not triggered
Security concepts
Assertion integrity
SAML must be signed and validated.
Trust chain
Only trusted IdP certificates allowed.
Time validation
NTP drift breaks authentication.
Least privilege
Map only required groups to VPN access.
Useful links
- https://docs.fortinet.com/
- https://community.fortinet.com/
- https://docs.fortinet.com/document/fortigate/latest/administration-guide
- https://docs.fortinet.com/document/fortigate/latest/cli-reference
- https://learn.microsoft.com/entra/identity/
- https://wiki.oasis-open.org/security/saml
