Fortigate 40F Source users

[AAguilo]

Hi,

I've got a Fortigate 40F and the source objects you can see on the logs/fortiview they don't match the current user. It's like it's showing maybe the first user that connected with that IP, but it's not updating.

I've got it connected with LDAP.

How can I make it update the names so they are correct on the logs?

Thanks,

Albert

[seshuganesh]

Hi Team,

I understood your query.

Could you please let us know what is the IP address associated with that user under dashboard >>users and devices
Is it updating there?

Please keep us posted

[AAguilo]

The IP's are correct and the hostnames are correct. The only thing it's not updating is the username. And it's showing the wrong user everywhere, on the logs, on the dashboards...

[seshuganesh]

May i know how the user is getting authenticated with the firewall?

Is it only through device identification or through any other authentication mechanism like captive portal or FSSO?

[AAguilo]

Only through device identification. It's set up at the users interfaces with the "device detection" setting

[Debbie_FTNT · Accepted solution]

Hey AAguilo,

FortiGate might simply not see different user information through device detection. Any user information via device detection is a guess at best, based on what information FortiGate was passively able to detect.

A somewhat more thorough explanation: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-unauthuser-and-unauthusersource/ta-p...

There isn't really a way for FortiGate to forcibly update the user information.

You can delete the device entry via CLI (dia user device del <MAC address>), but that's about it, and FortiGate might start filling in different user information found through device detection.

[AAguilo]

Thank you for this explanation, i thought the device identification would update the information. Knowing this i will just delete the devices having this issue so they can be identified again.