Skip to main content
akala
akala
Explorer
August 5, 2022
Solved

Fortigate Combining RSSO and FSSO

  • August 5, 2022
  • 2 replies
  • 11935 views

Hi All,

 

Is it possible to combine RSSO and FSSO on the sametime ?

 

I want to configure the policy using FSSO group becasue FSSO Group is more granular for the grouping as we can choose or retrieve the SG / OU on the AD which we want to add. And in the sametime i want fortigate to lookup on the RSSO authentication table list for IP to User mapping. Because RSSO is more reliable fof IP to User mapping. However i dont want to add attribute class on the Radius Server. So basically i just want to use RSSO to get the IP to user mapping information, and use FSSO group on the Policy.

 

Is it possible ? any advice ?

 

Thanks

akala

Best answer by Debbie_FTNT

Hey akala,

 

apologies, I was under the impression you're already using Collector Agent for FSSO, and the integration would have been fairly easy then.

If you are not using Collector Agent, can you let me know if you're polling from FortiGate directly, or using FortiAuthenticator to collect and provide FSSO information?

If you use FortiAuthenticator, you can do essentially the same (send RADIUS accounting to FortiAuthenticator, turn that into FSSO and share with FortiGate), but if you're polling AD directly from FortiGate, this would in fact require setting up a Collector Agent (and you could consider shifting your polling from FortiGate to Collector Agent, as Collector Agent offers more configuration options for that, and load on FortiGate itself would be reduced).

In either case, for Collector Agent setup:
- it needs to run on a server in your AD environment (that server can't also host a FortiClient EMS application), but it doesn't have to be a domain controller

https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/573568/installing-the-fsso-agent
https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/615946/agent-based-fsso-for-windows-ad

-> there could be conflict if you have an NPS role on the same server as the default port of 1813 might overlap
- you need to enable RADIUS accounting in the advanced settings on Collector Agent:

Debbie_FTNT_0-1659707180586.png

2 replies

Debbie_FTNT
Staff & Editor
Debbie_FTNT
Staff & Editor
August 5, 2022

Hey akala,

you can do something like this with the following setup:

- instead of RSSO on FortiGate, send accounting to collector agent

- Collector Agent can parse the radius accounting messages and add the users to FSSO user list

- Collector Agent then checks LDAP for group info

- Collector Agent sends logins from RADIUS accounting as FSSO logins (with FSSO groups) to FortiGate

- On FortiGate, you would just see FSSO users, but some of those FSSO users come from RADIUS Accounting indirectly

    Paccers
    Paccers
    New Member
    March 21, 2024

    Hi @Debbie_FTNT I just wanted to ask one thing around sending RADIUS Accounting to the collector agent.

     

    If we forward Accounting to the FortiGate for RSSO session creation, there is the 'set rsso-flush-ip-session' command available which we can use to NOT close a session if an Accounting Stop is received.

     

    Is there a way to be able to do this if we're sending RADIUS Accounting via the agent and not direct to the FortiGate?

    Debbie_FTNT
    Staff & Editor
    Debbie_FTNT
    Staff & Editor
    May 27, 2024

    Hey Paccers,

    sorry, I only just saw your post. To my knowledge, there is no such setting on Collector Agent, sorry.

    akala
    akalaAuthor
    Explorer
    August 5, 2022

    Hi Debbie,

     

    Thank you for the replies. That's great! that's the information i was looking for this couple days!

    So instead of using RSSO, i can use Collector Agent, and send the Radius Accounting to Collector Agent.

    Regarding the Collector Agent,

    1. do i need to install the collector agent on the LDAP Server or i can install collector agent on any computer ? i red that installing collector agent requires to restart the host, is it correct ?

    2. is there any configuration need to be done on the Collector Agent, so it can parse the radius accounting messages and add the users to FSSO user list? any reference for integration between radius and collecor agents?

     

    Again, thank you for your advice.

      Debbie_FTNT
      Staff & Editor
      Debbie_FTNTAnswer
      Staff & Editor
      August 5, 2022

      Hey akala,

       

      apologies, I was under the impression you're already using Collector Agent for FSSO, and the integration would have been fairly easy then.

      If you are not using Collector Agent, can you let me know if you're polling from FortiGate directly, or using FortiAuthenticator to collect and provide FSSO information?

      If you use FortiAuthenticator, you can do essentially the same (send RADIUS accounting to FortiAuthenticator, turn that into FSSO and share with FortiGate), but if you're polling AD directly from FortiGate, this would in fact require setting up a Collector Agent (and you could consider shifting your polling from FortiGate to Collector Agent, as Collector Agent offers more configuration options for that, and load on FortiGate itself would be reduced).

      In either case, for Collector Agent setup:
      - it needs to run on a server in your AD environment (that server can't also host a FortiClient EMS application), but it doesn't have to be a domain controller

      https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/573568/installing-the-fsso-agent
      https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/615946/agent-based-fsso-for-windows-ad

      -> there could be conflict if you have an NPS role on the same server as the default port of 1813 might overlap
      - you need to enable RADIUS accounting in the advanced settings on Collector Agent:

      Debbie_FTNT_0-1659707180586.png

        akala
        akalaAuthor
        Explorer
        August 5, 2022

        Hi Debbie, 

        thank you for the reply. actually we have not configure the FSSO yet on our deployment. Still planning how we will do it. Based on your information, i think the best way is to use collector agent. And send the radius accounting from the NPS to the CA.

        So installing the CA on any computer which joined domain will works right ? is it require to restart the computer after installing the CA ?

        Terms & ConditionsAccessibility statement