fsso with two collectors agent

[magnumpi]

In a redundant configuration with two collectors agent, is it possible that the same DC agent communicate at the same time with two collectors? thanks

[fropert_FTNT]

Yes, Simple add a registry key for the second collector agent with its IP address and port under HKEY_LOCAL_MACHINE/SOFTWARE/Fortinet/FSAE/dcagent/ca where the DC Agent is installed.

[magnumpi]

great !!! why it is not documented? thanks a lot

[magnumpi]

Now the DC Agents pointed to the two Collector Agent, but the second Collector Agent has the " Show Service Status" empty, Why? in this normal? thanks

[Alivo__FTNT]

Hi, Yes, it is normal. FortiGate is connected to just one Collector Agent at a time. In case the Collector Agent or the DC fails, FortiGate will switch to the other Collector Agent specified in config user fsso. To see if it connects to the one you are talking about is to stop or restart the fsso service on the one that is connected to now. FortiGate will see it is not available and will attempt to contact and connect to the " secondary Collector Agent IP" For this reason it is a good idea to have all Collector Agent' s configuration synced. When the failover happens, nobody should notice anything at all.

[talkwithphil]

Hello, I am going through my first FSSO setup right now and curious about a few things here. Is it possible to setup the following. I have 2 fortigate 800C' s not in HA (two seperate units dont ask...), and a Primary and Secondary DC first fortigate -points to primary DC that has both DC Agent and Collector installed. add reg key as suggested to add the IP of the second DC agent on secondary DC second fortigate -points to Secondary DC that has both DC agent and Collector installed. Add reg key to add the IP of the first DC agent on Primary DC why would I do it this way versus First Fortigate -primary FSSO collector IP to Primary DC with DC Agent and Collector installed -Secondary FSSO Collector IP to Secondary DC with DC Agent and Collector installed Second Fortigate -primary FSSO collector IP to Secondary DC with DC Agent and Collector installed -Secondary FSSO Collector IP to Primary DC with DC Agent and Collector installed I feel like what i wrote as the second setup option makes more sense. No need for reg keys. I would assume as long as you have the correct password to communicate it wont care who its coming from, or will this cause problems in communication? My secondary fortigate is not active unless my core switches failover to the secondary switches which uses the secondary fortigate so unless its just pinging it to confirm a connection it shouldnt be doing anything else? -Phil