Fortigate | Implement AAD Group based firewall rules for FortiClient SSLVPN

@AZURE

1.1. Create SAML enteprise Applicarion. We will call it Fortigate SSL VPN

1.2. Define AAD User groups that will have access to the Enterprise Application. Take note of the Object ID as it will use later in the Fortigate firewall.

1.3. Download Enterprise Application's SSL certificate. This will be imported in the Forigate firewall manually on later stage.

@FORTIGATE FIREWALL

NOTE: Forticlient SSLVPN settings are ignored in this step.

2.1. Import Azure's Enterprise Application SSL certificate on Fortigate Firewall (downloaded in Step 1.3)

2.2. Create SAML Sign-Sign On group. We will call it 'ssl-azure-saml'

2.3. Create an User Group called 'AAD-SSL-VPN-USERS' pointing to the Object Id of the and the AAD Group (this can be found in Azure in step 2). This User group will be used in the Firewall Policies in order to filter 

2.4 .Create Firewall Policy to restrict traffic to VPN Users AAD group while using the AAD-SSL-VPN-USERS object.

If we wanted to restrict the traffic from another AAD Group we just need to repeat step 2.3 while creating another User group pointing to a different Object Id.

As an example, another AAD Group called HR Users with Object Id xxxxxxxx-yyyy-zzzz-aaaa-bbbbbbbbbbbb would need to be created as done in step 2.3 and then this new User group can be assigned to another Forticlient firewall rule to filter the traffic to this particular User group

Please note that it does not matter if the Fortigate User Group is being included in the Enterprise Application AAD groups list (refer to step 1.2) or not as it simply works :)