Technical Note: FSSO collector agent failover configuration

[FiFa_FTNT]

Description

This article provides an explanation of how to configure FSSO for failover.

Solution

In this scenario 2 DCs will be used: 2008 and 2012.  On both DCs are installed FSSO in version 5.0.0237.  Only one FSSO collector agent is connected to FortiGate unit at the moment.

The FortiGate configuration is shown below:

The 2012 server shows as connected to the FortiGate and IP address of 2012 server is in bold font. The FSSO service will now be stopped on the 2012 server (or simulate that  DC 2012 is not reachable).

The FortiGate then switches to the next FSSO collector agent specified in configuration.

In CLI the configuration is as follows:

config user fsso
    edit "fsso"
        set server "10.94.0.173"
        set server2 "10.94.0.174"
    next
end

FGVM010000018394 # diag debug authd fsso server-status

Server Name     Connection Status     Version
-----------     -----------------     -------
fsso            connected             FSSO 5.0.0237