Cybersecurity Forum

This forum is for all security enthusiasts to discuss Fortinet's latest & evolving technologies and to connect & network with peers in the cybersecurity hemisphere. Share and learn on a broad range of topics like best practices, use cases, integrations and more. For support specific questions/resources, please visit the Support Forum or the Knowledge Base.

New Contributor III

FSSO Collector Agent issue

Check the reply below for proper steps.

First, I did not find any section just for FSSO or Authentication, so I posted it here. Move it as needed.

I ran into some issue with Fortigate with FSSO Collector Agent. The setup is:

  • Two Windows 2012 AD servers for one domain.
  • No DC Agent
  • FSSO Agent is installed on one of the windows 2012 member server for polling both ADs and advanced access mode.
  • Fortigate is configured LDAP servers for the AD servers
  • Fortigate is configured with two Single Sign-On for two user groups from the same domain (e.g. SSO 1: Domain Users; SSO 2: Polit Users)
  • Fortigate is configured with two firewall user groups for the two SSO (Group 1: Domain-User-Group; Group 2: Polit-User-Group)

When check the FSSO logons via User & Devices->Monitor->Firewall, I can only see the logons for Group 1. Even I logoff/logon manually with an account from the Polit-User-Group, there is still nothing showing on Firewall.

Anything I am missing OR I should check?

New Contributor III

From what I tested so far, if the two group doesnot have shared users, then the user logon info will be shown on firewall with individual group; but if the user belongs to both user groups, then the firewall only shows the user logon info for the group has more users...

Can anyone confirm this is the expected result?

New Contributor III

Here are the proper steps:

Create LDAP Connection to AD

Create SSO Entry via FSSO for the interesting AD groups (all the groups you would want)

Create User Group on Firewall to utilize the specific AD group via the single FSSO


Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.