FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article proposes a troubleshooting of missing logon events on an FSSO Collector Agent (FSSO CA) from a TS-Agent, or communication between them.
Scope
FSSO Collector Agent, FSSO TS-Agent.
Solution
All outputs could be attached to a TAC ticket for further tackling and could be used for the troubleshooting between FortiAuthenticator acting as the FSSO CA, and the TS-agent as well:
Verify communication between the FSSO CA and the TS-agent. Sniffer a port between them, the default port is 8002, UDP. The secured connection uses TLS over TCP.
Verify if there is no firewall policy blocking the traffic between agents.
If the traffic is allowed by firewall policies, verify by disabling the TS-agent installed server’s OS firewall.
Verify if there is no antivirus installed on the host, which denies communication between agents. Try to disable it, and test communication.
Perform the same steps on the FSSO CA side: disable the OS firewall and antivirus to verify communication.
Execute these commands on the TS-Agent installed host console (execute commands as an administrator, 'right click' and select ‘run as administrator’):
netsh int ipv4 show dynamicport tcp netsh int ipv4 show dynamicport udp
sc query fssota msinfo32.exe <----- Save outputs as a file.
Reinstall TS-agent using an administrator account.
Logon to the TS-agent installed server with a testing user, then:
Execute a command below with a logged-on user's CMD console, and verify with the domain administrators about enforced GPOs (if there is any):
gpresult /r
Execute the same command using an administrator account(Keep logon session of the testing user, run as administrator):
gpresult /r
Another option is to install a new Windows Server, set up the TS-Agent, and check communication.
If nothing is fixed, grab all these outputs to the file, and upload to the TAC ticket.
