Two IPSec VPN clients from same NAT/router break SAML auth before IKE. 7.6.5

Hi,

After going over and configuring IPSec VPN Gateway with SAML (Authentik) from scratch I've discovered weird bug: -- When second clients connecting from the same router (NAT) it gets empty reply from fortigate SAML IKE Server and doesn't get through -- Another observation: if first client session running long like 8+ hours second client can connect -- first client can connect at no problem -- no IPsec logs in fortigate, only SAML flow and logout request after successful authorization on IDP side and redirect to fortigate.

I tried almost every settings in phase1

We just started using cloud EMS Fortigate F101 FortiOS: 7.6.5 Same bug on all client OS

Any thoughts ?