FSSO polling mode - can’t see user logins

Forum|Forum|7 years ago
June 23, 2019
16 replies
30421 views

Hi, We have a situation where we have setup ldap correctly and able to browse user directory, all groups etc showing as expected. Problem we have seen is any users logged in- not seeing by the firewall. There are no antivirus/firewall port blocks on the AD server, and an adminaccount used for polling. Firewall debug showing sent login info packet 1 and no login info received packets This is a 300e firewall in vdom mode- unfortunately running 5.2.10 which we cant upgrade just on the sly as it does have other live customers and fortinet tac not helping as its out dated version. Wondering if anyone else come across this before and share some pointers? We think its an issue on AD server but not wnough substance to prove it back to the end user. Thanks.

xsilver_FTNT

Staff

Hi Farroo,

unfortunately it's not clear, at least to me, what sort of authentication you are trying to do/have.

Is it LDAP based auth, or FSSO ? If FSSO then are you polling DC(s) directly from FortiGate or do you use Colelctor Agent installed on one of DCs (preferred option) ?

FarrooAuthor

New Member

Sorry xsilver, I thought I mentioned fsso.. polling mode on fortigate and no agent on dc- we have a number of other cust exactly the same setup, just having issues with this one and unable to prove its an issue with ad. We have setup the ldap server, on fortigate, then fsso using that server, able to browse advserver can see groups users etc, but not seeing any user logins. Acc on ad is admin and it can read user login events. Don’t know where else to look...

Alivo__FTNT

Staff

Hello Farroo,

first about the 5.2.10

("This is a 300e firewall in vdom mode- unfortunately running 5.2.10 which we cant upgrade just on the sly as it does have other live customers and fortinet tac not helping as its out dated version.")

FortiGate is a security device and its purpose is to protect. Old firmware versions, that are note supported anymore, can be (are) vulnerable to various vulnerabilities. Insecure security device loses it's purpose. Firmware needs to be up to date.

To the FSSO issue > which AD version customer has?

Do you monitor user groups who's users logons are expected to be seen?

Which Windows Security Logon Events are generated by users logons?

Alivo

Rafi

Visitor III

Hello,

I face same problem

My FG version is 6.0.9,
My goal is to built firewall policy and use policy with user instead of ip address'
I configured ldap server (user with admin privilege's)
I configured fabric connector (poll active directory), I can see all users, groups from AD but the connector status is down

I tried to debug with following commands:
diagnose debug application fssod -1:- [handle_reply:489] wrong format of data status. len 8 <> 4.

diagnose debug application smbcd -1
- smbcd: smbcd_process_request:947 got cmd id: 6
smbcd: smbcd_process_request:960 got rpc log field.
smbcd: smbcd_process_request:972 got rpc username: <user>@staff.technion.ac.il
smbcd: smbcd_process_request:978 got rpc password: XXXXXXXX
smbcd: smbcd_process_request:982 got rpc port: 0
smbcd: smbcd_process_request:988 got rpc logsrc: security
smbcd: smbcd_process_request:966 got rpc server: x.68.25.x
smbcd: smbcd_process_request:1015 got VFID, 0
smbcd: smbcd_process_request:1105 got rpc eventlog read command
smbcd: rpccli_eventlog_open:144 /Chroot_Build/12/SVN_REPO_CHILD/FortiOS/fortinet/daemon/smbcd/smbcd_smb4eventlog.h-144: evenglog handle get failed.
smbcd: rpc_cmd_eventlog_read:900 open rpc err(x.68.25.x:<user>@staff.technion.ac.il:0) from security log!, Please check correct server name, user name, password, port and log source

My system guy check in AD server and RPC is running
He also checked this:
Default credential validation success
Audit kerberos authentication success
Audit kerberos service ticket operations success
Audit other account logon events success

Any idea or help will be welcomed

Thanks

Debbie_FTNT

Staff & Editor

Hey Rafi,

two things you can check:

- sometimes, there can be issues if the user for polling is configured as 'domain\user' or 'user@domain'; try just username
- there was a change in how Microsoft allows access to security event log API last summer, breaking FSSO polling mode a bit; this is fixed in firmware version 6.2.10, 6.4.7 and 7.0.2
-> if your domain controllers are properly patched, you may be affected by this
-> upgrade FortiGate to 6.2.10, or get a Collector Agent instead to do the polling (Collector Agent is not affected as long as all domain controllers are patched) and have FortiGate connect to the Collector Agent instead.
This is fixed under bug ID 725056, if you want to check FortiGate release notes