Technical Tip: FSSO resource list
Description
This article provides a list of FSSO-related documentation, both community articles and official Fortinet documentation.
Scope
FSSO, FortiOS, FortiAuthenticator.
Solution
FSSO (Fortinet Single-Sign-On) is a mechanism by which FortiGate (or FortiProxy) devices may learn user logins from various sources (most commonly Windows AD) without requiring the user to authenticate actively to the device.
User identity and group membership information can then be used to apply tailored firewall policies and security profiles and restrict or allow access to resources as necessary to maintain a secure and transparent environment.
Explaining FSSO:
These articles are a good starting point for understanding FSSO concepts, components, and operating modes.
Broad overview of FSSO, its components, methods, and troubleshooting pointers. | |
An explanation of DC Agent mode in simplified terms. | |
Technical Tip: FSSO choose between DC Agent mode or Polling mode | A comparison between DC Agent and Polling mode. |
Technical Tip: How to switch FSSO operation mode from Standard Mode to Advanced Mode | A comparison between standard and advanced mode, when to use which mode, and how to switch. |
Useful for understanding FortiGate local polling limitations. | |
Explains FSSO architecture | |
FortiAuthenticator-side FSSO overview, including supported collection methods and polling behavior. |
Basic configuration of FSSO agents:
These are the community resources that help with Collector Agent/DC Agent/polling-related setup and behavior.
A guide on how to install the FSSO Collector Agent. | |
Technical Tip: Restricting a Fortinet Single Sign On Agent Service (FSSO) service account | How to configure the FSSO Agent service account with the minimum required privileges. |
Configuration/behavior for polling-based collection. | |
Configuration/behavior for DC Agent-based collection. | |
Technical Tip: Windows event IDs used by FSSO in WinSec polling mode | Useful for understanding which Windows log events FSSO monitors. |
Technical Tip: FSSO Group Filter configured on Collector Agent | How to configure FSSO group filter on Collector Agent (standard mode). |
Technical Tip: How FSSO Collector Agent performs name resolution | Explains workstation/IP resolution behavior. |
Technical Tip: Disable the DNS resolution of the FSSO DCAgent | DNS behavior control for DC Agent deployments. |
Technical Tip: How and why to use the 'Ignore User List' option in FSSO Collector Agent | How to suppress selected accounts from FSSO processing. |
Technical Tip: Excluding IP addresses from FSSO logon events | Ignore-list behavior for IP ranges. |
Shows a non-Agent source that can still feed FSSO sessions. | |
How to configure an FSSO setup redundantly. |
Configuration on FortiGate:
These resources cover how FSSO is added on the FortiGate side.
FortiGate connector for agent-based FSSO. | |
FortiGate agentless polling connector. | |
Technical Tip: Configure Fortinet Single Sign On (FSSO) for SSL-VPN users via Syslog | An example of how to configure FSSO to capture SSLVPN user logins via syslog. |
Configuring multiple FSSO Agents to connect to multiple FSSO CA Server monitoring mutiples Domain/Groups |
Configuration on FortiAuthenticator:
These articles cover FortiAuthenticator as the FSSO collector/source, including Mobility Agent, polling, filters, and SAML-related FSSO behavior.
FortiAuthenticator polling source configuration. | |
FortiAuthenticator syslog collection. | |
FortiAuthenticator RADIUS accounting collection. | |
FortiAuthenticator as collector with DC Agent. | |
Technical Tip: Configure FortiAuthenticator as Collector Agent and in Polling mode | FortiAuthenticator polling-mode configuration. |
FortiAuthenticator Mobility Agent setup. | |
FortiAuthenticator global pre-filtering and FortiGate-specific filtering. | |
Portal-based authentication sources that can generate FSSO sessions. | |
FortiAuthenticator SAML-based FSSO behavior. | |
API-driven creation of FSSO sessions. | |
Example showing FortiAuthenticator acting as the SP and forwarding FSSO information to FortiGate. | |
SSOMA example with Entra ID-joined workstations. | |
Endpoint-side SSOMA settings. |
Troubleshooting:
This section provides an overview of available FSSO troubleshooting documentation.
Troubleshooting Tip: FortiAuthenticator FSSO troubleshooting | Detailed FSSO troubleshooting guide for FortiAuthenticator |
Troubleshooting Tip: FSSO Complete troubleshooting for TAC tickets | Comprehensive FSSO troubleshooting guide. |
General operational and troubleshooting guidance. | |
Techincal Tip : Registry filter with event ID set to 0,1 or 2 on FSSO collector agent not working | Registry filter with event ID set to 0,1 or 2 on FSSO collector agent not working |
RADIUS accounting parsing and policy-match troubleshooting. | |
How to identify and read RADIUS Accounting log messages in Collector Agent debug. | |
Troubleshooting Tip: Troubleshoot FSSO for SSL-VPN users (FSSO CA is acting as syslog server) | Troubleshooting steps for setups involving Collector Agent and syslog. |
Troubleshooting Tip: How to troubleshoot FSSO agentless polling mode issue | Agentless polling troubleshooting. |
Technical Tip: Common reasons FSSO status shows as 'down' on the Firewall | Technical Tip: Common reasons FSSO status shows as 'down' on the Firewall |
Technical Tip: Optimization of FSSO workstation IP address verification | IP verification tuning. |
Technical Tip: Upgrading FSSO Agents |
