FSSO Agent on sub-DC with multiple version of FGT

Hi Cuong,

if we are talking about standalone installation of FSSO Collector Agent, then there is multiple scenarios and modes of it's operation. In short:

First you can have single Collector Agent on one DC or even on any Domain member machine (non-DC mode).

Then you can choose from 4 modes of operation :

1. agent based - DCAgent has to be installed on all the used DCs as we cannot predict which DC will be used by workstation as its %logonserver%

2. agent-less - NetAPI polling - oldest and I would not choose that mainly for possibility to loose logon events, no DHCP tracking, Limited MAC OS support, RTT has to be <9sec => fast/small networks only

3. agent-less - WinSec polling - again, polling = transparent mode, DHCP tracking, MAC and Citrix farms support, in large networks might incure auth delay but no loss of logons

4. agent-less - WinSec-WMI polling - similar to previous but it question DCs via MS WMI API rather then reading fata blocks from Windows Security log (preferred)

So I would suggest WinSec-WMI in Advanced mode (groups in LDAP format, Group Filters configurable from FortiGate => no need to reconfigure Collector) on a single Collector in network. Later consider secondary Collector just for redundancy and fail-proofing your solution.

There could be used NTLM as auth fallback.

Regarding FSSO Agents and FortiOS version matrix .. there is no official support for the mix and currently supported FSSO is stated in interoperability section of respective FortiOS Release Notes.

HOWEVER .. there is not many changes in FSSO protocol, and therefore it should and usually works pretty well in mixed FortiOS. As far as you use FSSO version 5.x with FortiOS versions 5.x you should be safe and it should work. So you can use latest FSSO and connect older FortiGate units to that same Collector without any problem.

More important is, if you run in agent mode, or use TSAgents, to have FSSO parts within same version, so if Collector runs 5.0.0244 then all the other agents should run same or as close as possible version.

Hope it's clear now.