Technical Tip: Understanding the visibility of change-detection and change-detection-period under 'config user domain-controller'

Description

This article describes the CLI visibility of change-detection and change-detection-period parameters under a user's domain-controller configuration.

Scope

FortiProxy v7.0.9+, v7.2.3+.

FortiGate 7.2.5+.

Solution

The change-detection and change-detection-period parameters are conditionally available based on the Domain Controller configuration.

This is the default domain-controller configuration.

config user domain-controller
    edit "dbs-domain-controller"
        set ad-mode none
    next
end

When ad-mode is set to none, the FortiProxy does not detect configuration changes on the configured domain controllers because they are not configured as Active Directory Domain Controllers (AD DCs) or Active Directory Lightweight Directory Services (AD LDS) domain controllers.

As a result, the following commands are not applicable and are not displayed in the CLI:

set change-detection [enable|disable]
set change-detection-period {integer}

Steps to enable CLI visibility for the change-detection and change-detection-period parameters:

1. Configure ad-mode as 'ds' or 'lds'.

For example:

config user domain-controller
    edit "dbs-domain-controller"
        set ad-mode ds
    next
end

After changing ad-mode to 'ds' or 'lds', the following command becomes available:

set change-detection [enable|disable]

However, change-detection-period is not immediately displayed.

2. Enable change-detection.

When change-detection is set to disable, the change-detection-period parameter remains hidden:

set change-detection disable

This is because the change-detection interval is only applicable when change detection is enabled.

To make change-detection-period available, configure:

set change-detection enable

After change-detection is enabled, the following command becomes available:

set change-detection-period {integer}

The default value of change-detection-period is 60 minutes (range: 5–10080 minutes).

3. How to Troubleshoot the Change-Detection Functionality.

To capture the relevant debug logs, run the following commands:

diagnose wad debug enable category auth
diagnose wad debug enable level verbose

For example, the configuration may be as follows:

• 'set change-detection enable' is set, which is normally disabled by default.

• 'set change-detection-period 5' is configured to set the interval to 5 minutes (the default is 60).
  

set change-detection enable
set change-detection-period 5

In this case, the FortiGate will check the USN (Update Sequence Number) value every 5 minutes. This value indicates whether any changes have occurred on the Windows LDAP server (e.g., a user being moved from one group to another) as reported by the Windows Domain Controller.