Technical Tip: FortiGate FSSO Polling mode (Agentless) benefits and limitations

To get the configuration guidance for FSSO polling connector or agentless mode, follow this KB article: Technical Tip: FSSO Agent in polling mode.

In the agentless approach, FortiGate/FSSO Agent polls domain controllers directly to obtain user logon information, eliminating the need for a separate agent installation on DC. While this simplifies deployment, there are performance and scalability considerations to be considered.

Advantages of Agentless FSSO (Polling Mode):

• Simplified Setup: FortiGate(as local poller) or FSSO Agent handles the entire process, so no additional software or servers are needed.
• Lower Resource Requirements: No dc agents means fewer components to manage.
• Cost-Effectiveness: Suitable for small to mid-sized deployments where deploying a dedicated Windows server just for FSSO is impractical.
• Direct Integration with Domain Controllers: FortiGate or FSSO Agent connects directly to domain controllers using WMI and NetAPI, streamlining the authentication process without intermediaries.
• Ideal for SME Environments: This mode is particularly effective in smaller networks with fewer users and relatively static authentication patterns.

Limitations of Agentless FSSO (Polling Mode): 

• Scalability Constraints: As the number of users and authentication events increases, the polling process can place additional load on the FortiGate and domain controllers. This can lead to performance degradation in large environments.
• Resource Overload on FortiGate: The polling process involves reading event logs from the domain controller over WMI, which consumes CPU and memory on the FortiGate.
• Limited Logon Coverage: Certain login scenarios, such as remote desktop sessions, cached credentials, or users logged into multiple devices, may not be captured accurately.
• Delayed Logon Detection: Since polling occurs at set intervals, user logins may not be detected immediately, resulting in minor delays in policy enforcement.
• Fewer Advanced Features: Agentless mode lacks some of the advanced features available through the Collector Agent, such as logoff detection, workstation verification, and limited complex logon patterns.
  

Related documents:
FSSO polling connector agent installation 

Technical Tip: FSSO Agent in polling mode

Technical Tip: FSSO choose between DC Agent mode or Polling mode