Contributor II

Solved

FSSO Agent with collector agent

Forum|Forum|4 years ago
December 1, 2021
3 replies
5267 views

Hi Team,

i am trying to configure the fsso with agent collector.
Infrastructure:
- 2 sites with 1 FGT40F (v6.4.7) per site
- 2 AD with DC Agent
- 1 Collector Agent per site (advanced mode)

For some workstations, authentication is random.
I am thinking of the laptop that opens the session before being connected to the company network?

So I wanted to possibly do a redirect to the authentication portal if the user is not authenticated.
I tried to apply the method with set auth-method always and 2 rules.
But I don't get the portal.

I also need to check that ports 139 and 445 are open as well.

Do you have any suggestions or recommendations?

Thanks for your help

Julien

FortiGate

Best answer by xsilver_FTNT

Hi,

not sure I do understand your design, but ..

FSSO is passive pre-authentication based on source IP (optionally source IP and port range from Terminal Server with TSAgent), and knowledge gathered from already made login to MSFT Domain (anyhow).

So once user, or workstation on behalf of user, does some authorized action on MSFT domain, then this MSFT logon is spotted by FSSO components (DCAgent, Collector Agent). Processed. And completed info (username, source IP (port-range), user's group membership) is then pushed to connected FortiGate units (according to Group Filters, which are either set from FortiGate and pushed to Collector Agent, or set directly on Collector Agent and info is pulled to FortiGate(s)).

Therefore any attempt to connect somewhere, which is passing through firewall policy which does have FSSO based user group as requirement for authorized sources, will fail IF there is no user record in FSSO user list before such attempt.

"I am thinking of the laptop that opens the session before being connected to the company network?"

This is not going to work with FSSO.
You have to have either portal/auth set on interface where users are coming from, but that will apply to all of them. Or have portal active authentication driven from firewall policy with some active method like RADIUS, LDAP, or even on FortiGate locally defined users (not preferred).

xsilver_FTNTAnswer

Staff

Hi,

not sure I do understand your design, but ..

FSSO is passive pre-authentication based on source IP (optionally source IP and port range from Terminal Server with TSAgent), and knowledge gathered from already made login to MSFT Domain (anyhow).

So once user, or workstation on behalf of user, does some authorized action on MSFT domain, then this MSFT logon is spotted by FSSO components (DCAgent, Collector Agent). Processed. And completed info (username, source IP (port-range), user's group membership) is then pushed to connected FortiGate units (according to Group Filters, which are either set from FortiGate and pushed to Collector Agent, or set directly on Collector Agent and info is pulled to FortiGate(s)).

Therefore any attempt to connect somewhere, which is passing through firewall policy which does have FSSO based user group as requirement for authorized sources, will fail IF there is no user record in FSSO user list before such attempt.

"I am thinking of the laptop that opens the session before being connected to the company network?"

This is not going to work with FSSO.
You have to have either portal/auth set on interface where users are coming from, but that will apply to all of them. Or have portal active authentication driven from firewall policy with some active method like RADIUS, LDAP, or even on FortiGate locally defined users (not preferred).

Julien87Author

Contributor II

Hi Silver,

Thanks for your reply. Yes i wish failback authentication with portal if fsso user is not register in fsso user.

But after read your mail, i can not do a mix with this two authentication.

Thanks for your reply, i go look the last methode active to check if i can applied.

best regards,

Julien

xsilver_FTNT

Staff

Well, FSSO will not work without prior login.

But FortiOS does 2step policy check (since some 5.2.1), first for any IP based + those pre-authenticated (FSSO/RSSO etc), and then if it is supposed to hit implicit deny policy ID 0, then it starts second pass to have a look for active authentications (active auth based user groups like RADIUS,LDAP,TACACS+,local).
And so on policy based level it is supposed to fallback to active auth if there is no user.

Alternative is to use SSO_Guest_Users group, and so all the attempts are supposed to fall through that group as "authenticated" regardless we have no FSSO user list record. Important part is then policy order and SSO_Guests being used in last/bottom one policy.

Another possibility is to utilize explicit proxy and so 'config authentication XXX' parts (schema, rules and settings). Where there can be order of fallbacks defined as well.

Sign up

Login with SSO

Login to the community

Login with SSO