Skip to main content
aousien
aousien
Explorer
January 21, 2022
Solved

FSSO DC agent cannot get DNS name of domain

  • January 21, 2022
  • 2 replies
  • 7399 views

Hello , 

 

I have DC agent installed on the Domain Controller, and FAC debug indicate that it's getting the user and workstation details, but that it cannot resolve the DNS name for the workstation domain 

error below from FAC FSSO debug ( FAC is acting as collector agent )

 

any ideas or tips on where to look?

the workstation domain name is like mydomain.subdomain.local, so I have added subsomain.local to the DNS suffix in the DC agent config page, but still with no luck. appreciate anyone's help. Thanks


01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: decoded workstation: WKS01
01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: decoded domain: MYDOMAIN
01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: decoded user: userx
01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: has 0 ipv6 address
01/21/2022 15:32:04 [F4555555] DC/TS Agent [WARN]: cannot get DNS name of domain MYDOMAIN from Domain Manager
01/21/2022 15:32:04 [F4555555] DC/TS Agent [WARN]: Failed to decode DCTSA packet from 10.119.216.31:56581

Best answer by Hatibi

Hi,

 

what events do you get from the Domain Manager debug logs?

You can check at https://<FortiAuthenticator-IP-Address>/debug

On the top left services select FSSO Domain Manager.

Check the timestamp to see events that correlate to the events in DC/TS Agent service.

 

When you select "FSSO Domain Manager" service you also get a function on the GUI named "Rebuild SSO domains". If you enable this it will generate new events related to the status of the Domain Manager and you could get more information on the issue.

 

More information on troubleshooting here:

https://docs.fortinet.com/document/fortiauthenticator/6.0.7/administration-guide/120058/debug-logs#Debug_logs

 

Regards,

S

2 replies

Hatibi
Staff & Editor
HatibiAnswer
Staff & Editor
January 21, 2022

Hi,

 

what events do you get from the Domain Manager debug logs?

You can check at https://<FortiAuthenticator-IP-Address>/debug

On the top left services select FSSO Domain Manager.

Check the timestamp to see events that correlate to the events in DC/TS Agent service.

 

When you select "FSSO Domain Manager" service you also get a function on the GUI named "Rebuild SSO domains". If you enable this it will generate new events related to the status of the Domain Manager and you could get more information on the issue.

 

More information on troubleshooting here:

https://docs.fortinet.com/document/fortiauthenticator/6.0.7/administration-guide/120058/debug-logs#Debug_logs

 

Regards,

S

    clisecure
    clisecure
    New Member
    October 4, 2024

    I am getting an error like the one below and I haven't found a solution.

    10/04/2024 23:55:36 [F23946C0] FCT LOGON 2024-10-04-23:55:36/1970-01-01-00:00:00 FortiClient (null):DESKTOP-21111.XXX.COM/10.13.0.48 XXX.COM/ENTRATESTUSER1
    10/04/2024 23:55:36 [F23946C0] Exclusion List [DEBUG]: Looking up user ENTRAUSER1 [3,-1] in exclusion table
    10/04/2024 23:55:36 [F23946C0] FCT 10.13.X.X: SSOMA UUID: 100951064CXXXXXXXXXXX EMS S/N: (null) EMS tenant ID: (null)
    10/04/2024 23:55:36 [F23946C0] FCT 10.13.x.x: cannot get DNS name of domain XXXXX.COM from Domain Manager
    10/04/2024 23:55:36 [F23946C0] FCT disconnected: 10.13.x.x

    Debbie_FTNT
    Staff & Editor
    Debbie_FTNT
    Staff & Editor
    October 7, 2024

    Hey clisecure,

    based on the log snippet, it looks like the following is happening:

    -a FortiClient or FSSO Mobility agent is reporting a login to FortiAuthenticator with a workstation name DESKTOP-21111.XXX.COM

    - FortiAuthenticator looks for the domain XXX.COM but doesn't find it

    -> if you check under Monitor > SSO > Domains, you can see what domains FortiAuthenticator is aware of, including DCs

    -> the domain XXX.COM should be listed here if FortiAuthenticator is able to discover it via LDAP lookups

    -> if the domain is not listed here, then FortiAuthenticator is not aware of it and cannot process FSSO logins for it

    -> in that case, adding a remote LDAP server for that domain should help

      xsilver_FTNT
      Staff
      xsilver_FTNT
      Staff
      April 21, 2022

      Hi aousien,

       

      as you mentioned FortiAuthenticator (FAC) as the collector being listening to DC Agent (installed on AD/DC), then I assume you have FAC / GUI / Fortinet SSO Methods / SSO / General / "Enable DC/TS Agent Clients" enabled.

       

      And so FAC / GUI / Monitor / SSO / "DC/TS Agents" shows your DC Agent connected.

      Also .. SSO / Domains shows your AD domain and structure and individual DCs as green.

      If that second part (Domain monitor) is not OK, then check <FAC-IP-FQDN>/debug/domain-manager/ log for any connection errors.

      Domain manager gets this info from either Fortinet SSO Methods / SSO / Windows Event Log Sources (if you would do DC polling). But as you claimed using DCAgents, then your possible source might be FAC / GUI / Authentication / Remote Auth. Servers / LDAP setting with bond to Active Directory Domain via "Windows Active Directory Domain Authentication" setting inside LDAP server setup.

      Properly set up DNS is crucial part of SSO. I just guess that your AD/DC is also your DNS server, but that could be separate server or even non-Microsoft DNS (like Bind).
      So another thing to help with resolution is FAC / GUI / System / Network / DNS  having one of set DNS  servers set/pointing to AD/DNS, or your actual DNS server.

      Another thing to help is actual DC Agent, as by default it will try to resolve hostnames gathered from logon attempts in LSAS via local OS in which it is installed.
      DCAgent hostnames resolution capability is controlled by those self-explanatory registry keys "donot_resolve" and "Domain_DNSsuffix" in [HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FSAE\dcagent] .

       

       

        Terms & ConditionsAccessibility statement