Technical Tip: Configuring FSSO from FortiManager

[Nur]

Description	This article describes how to configure FSSO from FortiManager and push the configuration to FortiGate.
Scope	FortiManager and FSSO.
Solution	Refer to the steps below. Fabric View -> Create new fabric connector. Assign the AD IP Address -> FSSO Password -> default port 8000. FSSO: When choosing the collector agent, there are two types the user/group will display. The setting can be viewed from the 'set directory access' information.                                                                    'Standard' shows the mydomain/mygroup. 'Advanced' shows the LDAP Distinguished Name. The following screenshot from a lab test shows the standard settings: There are 3 options to fetch the User Groups (adgrp) from the Collector Agent: Collector Agent: Here FortiManager should be able to connect to Collector Agent directly to fetch the user groups. Via FortiGate: Here the request will be sent from FortiManager to FortiGate, it is the FortiGate that will communicate with the Collector Agent and fetch the user groups. Later, fetched user groups will be imported/synced to FortiManager. Local: It needs an LDAP server to be configured in FortiManager. FortiManager will connect to the LDAP server to fetch the user groups. Later, the admin must select the required user groups. Select the User Group Source and select OK. Later, select Apply & Refresh to fetch the User Groups. After, create the following objects to assign to the policy rules. From FortiGate, the FSSO object can be seen. Verify from the FSSO side as it displays the FortiGate information and not the FortiManager information.