SSO direct pooling - unusual traffic and CPU load
- August 30, 2018
- 1 reply
- 5819 views
Hello,
I configured SSO/Identity-Poll Active Directory Server on FGT81E (v6.0.2) against DC W2016 customer. By yesterday, everything worked ok. Today I noticed an unusual traffic on the interface to DC (15Mbps in and 3Mbps out). The FGT CPU is loaded to about 30-50%, and according to the diagnosis the process that causes it is "smbcd" . I checked the entire network for a loop. Then I disable the SSO on FGTand it all stopped (traffic and CPU load).
When I review the FGT Local Log, I see that FGT sent SMB to DC - see the screenshot
Any idea please? Is it better to use native SSO queries or using FSSO collector installed on DC?
SSO cfg:
config user fsso-polling
edit 1
set status enable
set server "172.28.0.2"
set default-domain ''
set port 0
set user "*****"
set password ENC G2uc5cCSGI9O4YfmFxE1Tlc93smM******H6J3bA6TqxsQukmYIDRhKeJocDeCOblAjyRLu8+XCTAGMYGoqXp+zAxAiCq0jNhs54szG9gI2XhkEu5qZe/mdxdFBaXCKlnZs/yTEiJOxZqsc4/s1wImzvmPA3g4s5B6mTGRvhI9bv2PXhaELCWgaJvF12WhE4vxQ==
set ldap-server "SX-PDC"
set logon-history 8
set polling-frequency 10
config adgrp
edit "CN=Domain Admins,CN=Users,DC=***,DC=local"
next
edit "CN=****,CN=Users,DC=***,DC=local"
next
edit "CN=Domain Users,CN=Users,DC=***,DC=local"
next
end
next
end
config user fsso
edit "Local FSSO Agent"
set server "127.0.0.1"
set port 8000
set password ENC T+pj6xGEiSGURtNFUrj+jgBzM66h2xYPJtgMNcywfP+YCzmqcEG1pKHf5nwPXPMO0qY2bmPveBbx3Qt/AmAeKxJTtxrjt9zgDXVbe5Wb9lJQZr9bYW0esEwZK2O3t/XbRsEmg1QjJkT7RqnfEC3ECfDWVNg1hcaQjOpz7Z7krcsZnhDM+5ujSjzc+H0K9L7NdY9how==
set source-ip6 ::
next
end
config user ldap
edit "SX-PDC"
set server "172.28.0.2"
set secondary-server ''
set tertiary-server ''
set source-ip 0.0.0.0
set cnid "sAMAccountName"
set dn "dc=****,dc=local"
set type regular
set username "****"
set password ENC 9ewB6iD5d9FEylv+YK75OalgQlVLaeemOhcOG8sTTG8TB+N4b0+Jji6qy0CtXJ2sQcftRZrqb6GUGmFjak99K5wY88FLVyZPu/jN7s4HTXcUqub0cwhxoq0vjEdEvnxPk/wwY//mtLBKafLKqY9/1hsG+GLGBMJza4eNcmB+gBgejeK3J55JfBfABr6HIUh5z5K00Q==
set group-member-check user-attr
set group-search-base ''
set group-filter ''
set secure starttls
set ssl-min-proto-version default
set ca-cert ''
set port 389
set password-expiry-warning disable
set password-renewal disable
set member-attr "memberOf"
set account-key-processing same
set account-key-filter "(&(userPrincipalName=%s)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))"
next
end
PID RSS ^CPU% MEM% FDS TIME+ NAME
* 298 7M 49.2 0.4 8 00:02.22 smbcd [x2]
139 18M 21.3 1.0 11 00:03.65 httpclid [x3]
127 32M 4.7 1.7 25 01:48.83 httpsd [x6]
125 34M 0.8 1.8 60 00:35.35 miglogd [x3]
131 4M 0.0 0.2 11 00:03.59 merged_daemons
132 7M 0.0 0.4 13 00:00.25 fnbamd
133 4M 0.0 0.2 12 00:00.80 fclicense
134 14M 0.0 0.8 22 00:06.55 forticron
129 4M 0.0 0.2 8 00:00.00 getty
136 7M 0.0 0.4 15 00:01.50 forticldd
137 6M 0.0 0.4 47 00:00.16 authd [x3]
138 6M 0.0 0.3 24 00:00.20 foauthd
130 122M 0.0 6.5 373 00:30.24 ipsmonitor [x6]
142 16M 0.0 0.9 31 00:06.62 sslvpnd [x4]
143 4M 0.0 0.3 11 00:00.90 info_sslvpnd
144 6M 0.0 0.3 10 00:00.90 guacd
146 4M 0.0 0.3 53 00:02.20 proxyd [x3]
147 6M 0.0 0.3 23 00:00.54 voipd
148 61M 0.0 3.3 182 00:42.47 wad [x8]
149 32M 0.0 1.7 57 00:23.85 scanunitd [x5]