Skip to main content
bartynp
New Member
November 8, 2023
Question

FortiEMS - ActiveDirectory Home Folders access/mount

  • November 8, 2023
  • 4 replies
  • 2193 views

There is a environment like below:

 

  1. AD located in the cloud
  2. EMS serwer located in the cloud
  3. On the edge of the cloud, there is a FG virtual machine
  4. In the branch, there is a FG and Fortiswitch
  5. There is a VPN IPSEC tunnel between the branch and the cloud (from FG located in the branch to FG Virtual Machine, located in the cloud)

Firewall rules contains ZTNA tags in the branch FG and in the cloud FG; checking the traffic which goes to the machines located in the cloud.

 

  1. user connects computer to the fortiswitch in the branch
  2. port in the fortiswitch is in the NAC mode
  3. in the beginning; this computer first goes to the "onboarding" vlan; after two or three minutes later; computer has acces to company sites.

Each user has own home folder which access path is declared in te user AD account setting. But there is a problem. How to mount user home folder if the EMS server needs a few minutes before it authenticates the machine? Is there any solution?  

4 replies

Stephen_G
Staff & Editor
Staff & Editor
November 11, 2023

Hello bartynp,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Stephen_G - Fortinet Community Team
Stephen_G
Staff & Editor
Staff & Editor
November 13, 2023

Hello,

 

We are still looking for someone to help you.

We will come back to you ASAP.


Regards,

Stephen_G - Fortinet Community Team
bartynp
bartynpAuthor
New Member
November 13, 2023

thx :)

azaria23
New Member
November 13, 2023

If it is anything like the FortiSSO agent, it needs the privileges to run on a server with system context (domain controller probably) and / or just AD User read for AD (e.g. it just needs to talk to AD from a client machine).

bartynp
bartynpAuthor
New Member
November 13, 2023

it talks; but when there is "onboarding" process (NAC port i fortswitch, vlan changing); it takes time; user logs into the system (using cached credentials) before the windows can talk to the AD or wait until the computer connects to the network. There is no chance to talk to any system before; there is no connection during "onboarding process".