Skip to main content
Nick_Bligh
Nick_Bligh
New Member
March 3, 2018
Solved

FSSO User Logon

  • March 3, 2018
  • 2 replies
  • 29817 views

Hi 

 

As I understand it a user logs on to the domain, the FSSO agent captures this logon and sends it to the Firewall, does anyone know how long this event stays live.

 

I have an issue where users are in the list of logged on users in the morning but later in the day the seem to be missing and therefore lose internet access.

 

Nick.

 

    Best answer by xsilver_FTNT

    Hi,

     

    in general, the event stays alive forever unless something from bellow happen ... 

    1. user logs out and logoff is spotted via WMI

    2. you manually clear logged on users, they are not read in from DC again unless they re-login (new logon spotted)

    3. different user is spotted as logged on from the same workstation (this cause original user being overwritten and considered logged off, as workstations are treated as being used by one active user at the time, unless we talk about Terminal Server with FSSO TS-Agent which can handle multiple users on the same terminal server properly)

    4. workstation verification failed, then dead entry interval is applies (default 8 hours) and .. if there is no successful verification, or new user logon action (any AD action requiring authorization), then user is removed from FSSO user list after dead entry times out

     

    See timers mentioned by Marco for more details or check Authentication admin guide on https://docs.fortinet.com

     

    Kind regards, Tomas

    2 replies

    Marco
    Marco
    Explorer
    March 3, 2018

    Hi Nick

     

    do you have installed the collector agent? There are some Timer values:

    http://help.fortinet.com/...llector_agent_settings

     

    The collector agent also need access to the workstations to verify the user is still logged on: http://kb.fortinet.com/kb/viewContent.do?externalId=FD31772

     

    Marco

    xsilver_FTNT
    Staff
    xsilver_FTNTAnswer
    Staff
    March 5, 2018

    Hi,

     

    in general, the event stays alive forever unless something from bellow happen ... 

    1. user logs out and logoff is spotted via WMI

    2. you manually clear logged on users, they are not read in from DC again unless they re-login (new logon spotted)

    3. different user is spotted as logged on from the same workstation (this cause original user being overwritten and considered logged off, as workstations are treated as being used by one active user at the time, unless we talk about Terminal Server with FSSO TS-Agent which can handle multiple users on the same terminal server properly)

    4. workstation verification failed, then dead entry interval is applies (default 8 hours) and .. if there is no successful verification, or new user logon action (any AD action requiring authorization), then user is removed from FSSO user list after dead entry times out

     

    See timers mentioned by Marco for more details or check Authentication admin guide on https://docs.fortinet.com

     

    Kind regards, Tomas

    Rotempe
    Rotempe
    New Member
    October 9, 2018
    What if the DC agent see everything fine but the fortigate for some reason not see the assign groups? What can cause this? But logout login solve it..
    xsilver_FTNT
    Staff
    xsilver_FTNT
    Staff
    October 10, 2018

    Hi,

    first, DCAgent do not talk to FortiGate, but to Collector Agent which then talk to FortiGate.

    Second, DCAgent do not see any groups, just logons. Collector does all the work of getting right group membership data for logon event and user inside of it. Collector uses connection to LDAP to get MemberOf attribute.

    If there are no groups on FortiGate then either or all of this could happen:

    - Collector failed to retrieve group membership, because:

    -- has insufficient rights to read LDAP tree

    -- LDAP config is wrong (wrong server IP/Name, BaseDN)

    -- LDAP is unreachable

    - group membership was retrieved OK, but user do not belong to any of the groups used/allowed/monitored by Group Filter

    -- group filter is not set properly

    -- group filter not defined for particular FortiGate

    -- AD group (config user adgrp) not paired to firewall group (config user group)

    - one another reason might be that FortiGate has FSSO Agent set with LDAP, and therefore tries to update Collector's Group Filter with groups selected by FortiGate admin, those groups are in LDAP format, but Collector runs in Standard mode which uses Microsoft group name format, which is incompatible with LDAP format, and so groups are not matching.

     

    However as you stated that logout/login solved issue then I guess that there was probably short issue with LDAP connectivity and so user was not seen as part of any group.

     

    I'd turn debug level logging on Collector and check the log file for details. It's verbose enough to get idea what's wrong, mostly. Alternatively contact Fortinet Support and open ticket (attach FortiGate and Collector config + debug log + details about problematic used [name,date,time,groups he is supposed to belong to]).

     

    Terms & ConditionsAccessibility statement