Add multiple groups to the firewall policy.

@@GraniteDan Tried this, the issue is the same. Not able to add 2 different user groups(referencing two different saml server) to a firewall policy

Lots of reasons. 1st would probably be that no one security vendor catches everything. No matter how good their sales pitches are. 3rd Party feeds can complement Fortiguard services. Second might be in-house or industry maintained feeds. I used to work in higher education and lots of institutions across Canada pooled threat intel into a common misp database and those feeds could be ingested into member firewalls regardless of vendor. Or like the example in the video if you are running a dual stack internet connection and you want to block all traffic from TOR exit nodes both ipv4 and ipv6 (fortiguard ISDBs are ipv4 only). You may want to use a feed as an allowlist rather than a blocklist and you can do that using a feed because it just acts like an address object in a firewall policy. There are a lot of possibilities for this.

@@GraniteDan great... Thanks for the answer... Do we haver a risk tô block falar positives? How would we deal with that?

Rob, thanks I didn’t get into MFA other than maybe mentioning it. Azure AD handles the MFA side of things if you have MFA enabled either per user for via conditional access you will get prompted for MFA just like you would when logging into M365 or any other app.

That is exactly what the video shows you how to do.

@@GraniteDan I only see azure authentication with username/password. But I'm new to azure, I probably don't fully understand the 2FA process of azure. Afaik you need to accept the 2FA f.e. on your phone. The login procedure on SSL VPN doesn't show a page where it is waiting for acceptance of the 2FA.

@@Heineken1712 MFA is wholly managed by Azure AD. When it is enabled either per user or by conditional access and you are authenticating with Azure AD via SAML the user will receive the MFA prompts just as they do when logging into Any Office 365 cloud apps etc.

What sort of redundancy are you looking for?

@@GraniteDan we have multiple interfaces configured on SSL VPN, the question really is, should I create two multiple instances in Azure AD as well?

@@wascarreyes01 I don't believe this would be required. If all of the users exist in the same Azure AD. Should be able to setup a Single server and then allow specific groups.

@@GraniteDan What if my firewall’s public IP goes down?

@@wascarreyes01 If your public IP goes down then your users probably won’t be able to connect to the SSL VPN. For that level of redundancy you could look at multiple connections, SDWAN, and some load balancing for the FQDN that users are connecting to.

I do not know if this would be a limitation of the evaluation license or not. Validate you are downloading the correct version of the certificate. Do you get an error? Option not there?