Skip to main content
ARG
ARG
Explorer
January 12, 2024
Solved

Traffic logs showing a user associated with many different IP addresses

  • January 12, 2024
  • 2 replies
  • 1955 views

We are utilising the FSSO Agent to identify the logged in users and match them to traffic. In the traffic logs we have one user that seems to be matching to multiple IP addresses that are in different geographic locations.

 

What's also interesting is the MAC that's showing is a Cisco router.

 

Logs.jpg

The related device seems to be appearing in the fabric topology.

device.jpg

I have no idea how it's relating the device and user.

I'm only fairly new on Fortigates so a bit perplexed..

Any thoughts?

Best answer by pminarik

This is information gathered via device-indentification. (looking at SMB/Kerberos/DHCP/etc traffic to identify device/version/user/etc.)

Device identification works best/properly only when the endpoints have layer-2 connectivity up to the FortiGate. You seem to have a router in-between, causing all of these devices to appear with the same MAC address (the router's), which is know to throw things off.


Note that is info is not used for policy decisions (FSSO is still used for that), so this is "only cosmetic" and has no impact on what is allowed/blocked by firewall policies.

2 replies

pminarik
Staff
pminarikAnswer
Staff
January 12, 2024

This is information gathered via device-indentification. (looking at SMB/Kerberos/DHCP/etc traffic to identify device/version/user/etc.)

Device identification works best/properly only when the endpoints have layer-2 connectivity up to the FortiGate. You seem to have a router in-between, causing all of these devices to appear with the same MAC address (the router's), which is know to throw things off.


Note that is info is not used for policy decisions (FSSO is still used for that), so this is "only cosmetic" and has no impact on what is allowed/blocked by firewall policies.

    ARG
    ARGAuthor
    Explorer
    January 15, 2024

    Thanks. That makes a lot of sense.

    AEK
    SuperUser
    AEK
    SuperUser
    January 12, 2024

    In addition to what @pminarik said, only non-FSSO users behind a router will be shown like that. The FSSO users will be shown correctly with the user id even behind a router.

    As far as FGT can't identify the users it can't show the right user id, so to avoid that you have to implement any identification mechanism, like FSSO, active portal (and RSSO probably as well).

    AEK
      Terms & ConditionsAccessibility statement