Skip to main content
Liza1
Liza1
Explorer II
July 3, 2024
Solved

How to setup agentless polling on AD server

  • July 3, 2024
  • 3 replies
  • 3246 views

Hello! I need help with setting up agentless polling configuration on FortiGate.

I have a FortiGate device and an AD server where our company's users are located. I've been exploring the option of using agentless polling to implement and monitor these AD users in FortiGate. I'm having trouble adding FSSO-CA (FSSO Agent on Windows AD).

I can see the server and can telnet using port 445, but the FSSO-CA status shows as disconnected. Could the issue be related to the user? What privileges and rights does this user need? How should I correctly configure this setup so that FSSO Agent on Windows AD can see FortiGate and function properly?

Please assist me.
#FortiGate FortiAuthenticator FortiAnalyzer 

Best answer by ebilcari

If you want to use direct polling without a collector agent installed on the AD/DC you should configure "Poll Active Directory Server".

If you are choosing "FSSO Agent on Windows AD" you will need the collector installed on the AD as shown in this article. This communication is done on port 8000.

3 replies

Yurisk
SuperUser
Yurisk
SuperUser
July 3, 2024

If you ask about agent-less (direct) polling, see what I said here https://community.fortinet.com/t5/Support-Forum/Poll-AD-Server/td-p/324005 

 

yurisk.info - all things Fortinet blog, no ads
    Liza1
    Liza1Author
    Explorer II
    July 3, 2024

    do the FSSO need additional license? or can it work on a device without license? 

    Yurisk
    SuperUser
    Yurisk
    SuperUser
    July 3, 2024

    No, you don't need any additional license for FSSO, just regular FortiCare for your Fortigate so that you can download FSSO Agent install .msi from support.fortinet.com

    yurisk.info - all things Fortinet blog, no ads
      hbac
      Staff
      hbac
      Staff
      July 3, 2024

      Hi @Liza1,

       

      The following debugs on FortiGate will be useful:

       

      # diagnose debug application fssod -1
      # diagnose debug application smbcd -1
      # diagnose debug en

       

      Regards, 

        ebilcari
        Staff
        ebilcariAnswer
        Staff
        July 3, 2024

        If you want to use direct polling without a collector agent installed on the AD/DC you should configure "Poll Active Directory Server".

        If you are choosing "FSSO Agent on Windows AD" you will need the collector installed on the AD as shown in this article. This communication is done on port 8000.

        Emirjon
          Terms & ConditionsAccessibility statement