TS Agent : users not using affected ports

Hi,

Just ran into the same problem. Managed to fix it though not sure exactly which of these did it, but maybe you can give this a try:

-Use the .exe not the .msi to install - I have a feeling this may be it

-Use the TS and Collector agent version that matches your Fortigate (Not sure why this would make any difference though) - i.e. For Firmware 5.2.4 use agents version 5.0.0241

-In the Collector Agent, uncheck the Advanced Settings->Citrix/Terminal Server Virtual IP - default is unchecked but for some reason I thought it was required - haven't read up to see what it actually does though

-I also used 'Standard' mode on the Collector when it wasn't working. I switched to 'Advanced' mode and did the above at the same time, but I don't think this would make a difference.

HTH

Hello gentlemen.

@whinpo

described behavior where traffic is originated from system ports instead of user assigned ports is usually result of some sort of proxy in the system. Maybe some security application trying to do HTTP protection/scan. It will terminate customer connection on itself, scan and then open new connection to actually gather data requested by user. But in this case new, outer, connection will be opened by proxy and not by user, and proxy is most probably running as system service => system ports used. Check that browser do not has any proxy set, and there is not any transparent proxy in system.

netstat -aonb >c:/portsused.txt This command and flow debug on FortiGate could help you to identify which application is using which port range so if you on FortiGate see traffic flowing and failing auth from system ports, check who is using those ports.

@gavinm

Collector agent mode of operation (Standard vs Advanced) is just about the format in which group membership will be.

Standard does use MS format of DOMAIN/GROUP.

Advanced uses LDAP format CN=group,OU=Users,DC=example,DC=com

You have to be aware of that and make sure that FortiGate and Collector does use same format. Otherwise Group Filters will not match and you will have users on Collector but not on FortiGate etc.

When you attach LDAP to FSSO Agent on FortiGate config, then FortiGate will start to use LDAP format and push the selected groups to Collector as Group Filter. On Collector you can see that Group Filter is pushed from certain FrotiGate (SN bind).

Kind regards,

Tomas