Skip to main content
torenhof
torenhof
Explorer II
October 12, 2015
Solved

FSSO Group Filters & Ignore Users

  • October 12, 2015
  • 2 replies
  • 7006 views

Hello All,

 

We have configured FSSO on a FG300 running version 5.0 (GA 13)

In this config we are using group filters, but when I check the CA that is running on an A.D. server, we noticed that a service account was logged on multiple times (about 20 times). This service account isn't included in the A.D. servers' groups where we configured the groups that must be used in the identity based firewall policy.These groups have been configured/selected in the FG.

After I had excluded that service account, FSSO seems to be working.

Another important thing: we have upgraded the agents on the DC's but only restarted the services, we didn't do a complete reboot of each A.D. controller.

Could this be the culprit?

 

Best regards,Torenhof

 

    Best answer by Syed_Mehmood_Ali

    Its better to reboot the server whenever install DC agent or upgrade the agent. In my case I tested the DC agent without rebooting the server but results were not accurate.

    2 replies

    Syed_Mehmood_Ali
    Syed_Mehmood_AliAnswer
    New Member
    October 12, 2015

    Its better to reboot the server whenever install DC agent or upgrade the agent. In my case I tested the DC agent without rebooting the server but results were not accurate.

    torenhof
    torenhofAuthor
    Explorer II
    October 14, 2015

    OK, we have rebooted the servers. But we still needed to add service accounts to the ignore users list.

    The point of using group filters seems to be somewhat gone

     

    Thanks anyway for the reply.

    Regards

    xsilver_FTNT
    Staff
    xsilver_FTNT
    Staff
    October 15, 2015

    hello,

     

    make sure and double check that there is no slightest possibility of test account being included in allowed (filtered) user groups, keep in mind that if Collector runs in Advanced mode then group nesting is possible and so if group (LOW) is nested inside another group (TOP) then through this mechanism user can be seen as member or group (TOP) regardless he is not direct member of it. He will be there through TOP-LOW-user nested groups chain.

     

    If it still seems correct, open a ticket on support for that and we can test and raise a bug if issue confirmed.

     

    Best regards, Tomas

    Terms & ConditionsAccessibility statement