Solution | The main difference between Standard and Advanced modes is the naming convention for identifying groups. Standard mode: Uses the regular Windows convention: Domain\Username. Advanced mode: Uses LDAP: CN=User, OU=Name, DC=Domain.
If there is no special requirement to use LDAP, Fortinet recommends a setup of FSSO in Standard mode. This mode is easier to set up, has less configuration, and is usually easier to maintain and troubleshoot.
Standard mode will provide the same level of functionality as Advanced mode except for: Users have to create Group filters from the Collector Agent and not from FortiGate as with Advanced mode. This should not be a constraint and Fortinet strongly encourages users to create filters from the Collector Agent. The advanced mode supports nested groups. This means that users may be members of multiple monitored groups. Standard mode does not support nested groups so a user must be a direct member of the group being monitored. The packet size for the FSSO protocol is limited. Thus, when using advanced mode in CA without a group filter, only up to 2047 groups can be sent over. Â
 Prior to FortiGate version 6.0.x:
Starting with FortiGate version 6.2.x, 'Standard mode' has been renamed to 'Collector Agent,' while 'Advanced mode' is now referred to as 'Local'.
Collector Agent:
Local:
Selected when the FSSO Collector Agent is configured in Advanced mode. A Group Filter for users is defined on the FortiGate. The FortiGate can access the user information tree provided by the Collector Agent; however, specific users should be explicitly selected.
Related articles:
|
