FSAE Authentication

Hi Cisco, I am experiencing the same thing, but I am running e-Directory. I can be logged in to my PC and browsing the net and in the middle of a session authentication fails and I default to a guest status. This should not be happenning. It make it very difficult to configure rules for specific users when authentication fails. I have a support request open so if I get a good answer I will let you know the result. I am also getting errors on the server from the FSAE agent itself.

Not a solution, but some related information for you. . . I' m also using FSAE with edirectory. The FSAE agent tends to give off errors on the server. Don' t know why. Have not been able to solve. Others have reported the same issue (search forums for fsae), but seems to continue to function OK. I don' t use non-authenticated guest access, so have not seen the issue you' ve mentioned. Guest users need a guest password for a web login on my network. What firmware and FSAE version are you using? Once authenticated, the Fortigate needs to periodically re-authenticate the user if it hasn' t seen any traffic from that user. If that re-authentication fails, my guess is that it reverts security to Guest (unauthenticated). The trick is to find out why the re-authentication is failing. My advice would be to change your authentication timeout temporarily to something like 2 hours to see if that has any affect. If so, then at least you' ll know you' re on the right trail. The setting is in User|Options. If it' s any help, you can also use the CLI to set specific timeouts for different groups. My guest logins reauthenticate every 15 minutes. But my FSAE logins are much longer -- typically just people logging in for the day at their own desktops. No need to constantly reauthenticate those. Bill

Unfortunately I can' t set the time that high. I work for a school district where I have different people logging in to the PC' s all the time. I could increase the time out from 2 minutes to 15. I just saw your post on setting the groups for longer timeout times. That will be usefull for some users. I just don' t understand why I am getting a failure at all. I have 3 LDAP servers configured and 2 FSAE servers configured. Both of which are getting the annoying failure and restart of the service, which I think may be related to my authentication failures. If the service is failing when authentication is occurring authentication will fail. I am running 4.03 build 106 and have tried both of the latest FSAE e-Directory agents.

FWIW, I found this document on FTG site under the title " FSAE Users Appear to be logged as guests" [link=]http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=13149[/link] On the edir issue, I found I had fewer errors when using Native mode instead of ldap. I' m also experimenting with limiting the groups that it scans. We have a ton of groups, and it seems to monitoring all of them. FSAE documentation is not great, at least for the edir agent. Bill

Thank you Bill and Russ for your replies. I have been testing some things and don' t seem to be getting any FSAE errors on my DCs... The problems seem to start when an application on the computer requires a different login name. e.g. the user logs in to the computer with domain account john.smith - authentication will work and show him as john.smith in the logs. Then after a while if user John smith logs in to something like msn messenger as something else like smithie88 - the authentication fails and the log is recorded as guest. This also seems to be effected by scheduled tasks running as different users. so maybe changing the time period to a shorter time may in fact work better in my situation??... It would be nice to know exactly where the data is taken from by the fsae ad integration and if it could be changed.

Thanks Bob, the ignore list seems to be working. This command helps to troubleshoot a little as well.... diag debug authd fsae list If you view the log output from putty you get a clearer picture of what accounts have authenticated against the DCs.