New Member

Solved

FSSO DC agent show user logon with wrong IP address

Forum|Forum|2 years ago
November 6, 2023
4 replies
3474 views

We have FortiGate-200F with Firmware 7.2.5 at HQ

Our office have 4 site. Every site have 2 AD server. We install FSSO DC agent on every server.

Main server at HQ can monitor on other server normally.

But we have problem with 1 user that show correct user but wrong IP address in FSSO DC agent.

It show user: Cxxxxxx , IP: 192.168.0.109

but the correct was user: Cxxxxxx , IP: 192.168.0.127

We have try de-authentication from Fortigate and restart client laptop but FSSO DC agent still show wrong IP address

Please advise how can we solve this issue.

FortiGate

Best answer by rbraha

Hi @thitinon

Does the user after logs in is doing any RDP to another PC?

Make sure that your DNS server resolved correct wks.name to ip,you can do nslookup wks.name and check which ip it has taken on your end user PC.

Additionally you can check DC Agent logs and also you can set on Collector Agent Logging Level to Debug and increase the size to 100MB, try to logout/login with that users and check on both logs when an new event is generated for that user and any errors related.

saneeshpv_FTNT

Staff

Hi @thitinon ,

Could you enable debug logs on the DC agent (On the Server where user authenticate) and see if you could find some relevant information related to this issue.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-logging-on-DC-Agent-FSSO-DC-Agent/ta-p/196857

You may use SET command or run "echo %LOGONSERVER%" to identify the DC on which the Users PC authenticate.

Once the data is capture and still you unable to identify the reason, I would suggest you open a case with Support.

Best Regards,

rbrahaAnswer

Staff

Hi @thitinon

Does the user after logs in is doing any RDP to another PC?

Make sure that your DNS server resolved correct wks.name to ip,you can do nslookup wks.name and check which ip it has taken on your end user PC.

Additionally you can check DC Agent logs and also you can set on Collector Agent Logging Level to Debug and increase the size to 100MB, try to logout/login with that users and check on both logs when an new event is generated for that user and any errors related.

thitinonAuthor

New Member

@rbraha
Thank you.

We have check and found that someone has fix Hostname with IP: 192.168.0.109

Now it work normally.

pavankr5

Staff

Hello @thitinon,

Ensure that the DHCP server or static IP configuration on the client matches the correct IP address (192.168.0.127). the DC agent might cache information. Try clearing the cached data on the DC agent to see if it resolves the issue. Let me know if FSSO CA the workstation's status "OK" or "Not Verified".

Thanks

Pavan

Sign up

Login with SSO

Login to the community

Login with SSO