Skip to main content
danyal
Explorer
June 3, 2025
Solved

Fortigate FSSO works with user but not Global Security group

  • June 3, 2025
  • 2 replies
  • 1015 views

Hello,

 

I have set up a firewall policy to test our FSSO functionality. I have noticed that when the FSSO group corresponds to a user DN it works fine, however, if it corresponds to a Global Security group, it does not work.

 

Below is the firewall policy:

 

show firewall policy *** config firewall policy     edit ***         set name "TestFSSO"         set uuid f44e2db6-3fe8-51f0-****-6d00*****3be         set srcintf "lan"         set dstintf "wan1"         set action accept         set srcaddr "all"         set dstaddr "all"         set schedule "always"         set service "ALL"         set utm-status enable         set inspection-mode proxy         set profile-protocol-options "custom-default"         set ssl-ssh-profile "certificate-inspection"         set av-profile "default"         set webfilter-profile "Default"         set dnsfilter-profile "default"         set ips-sensor "Default"         set application-list "Default"         set logtraffic all         set nat enable         set ippool enable         set poolname "Web Browsing Users"         set groups "test fsso"     next end

 

What I mean is that if "test fsso" contains a user DN, the policy works as expected. If "test fsso" contains a GS DN, it does not. The GS I'm pointing out to has the same user member.

 

Any advice?

 

Thank you

Best answer by danyal

After talking to Fortinet Support Team, below solution looks to work for us.

https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-Windows-event-IDs-used-by-FSSO-in-WinSec-polling/ta-p/189910

2 replies

AEK
SuperUser
SuperUser
June 5, 2025

Hi Danyal

Is the group nested?

Can you try the group that directly owns the user?

AEK
danyal
danyalAuthor
Explorer
June 5, 2025

Hi Aek,

 

As I mentioned, it works when the user group owns the user directly. However, I would like to get it work with active directory Global Security.

danyal
danyalAuthorAnswer
Explorer
July 9, 2025