AD with fortinet integration not working

[okorosylvester]

Firewall_Robot # exec telnet 10.69.73.2 8000
Trying 10.69.76.2...
Timeout!
Failed to connect to specified unit.
Console line is in use. Clear it before next try.

Can i change the port  anybody with solution please send 

[dingjerry_FTNT]

Hi @okorosylvester ,

Based on your WireShark screenshot, I can tell that it is a "TCP Syn" packet, nothing else.

[okorosylvester]

When i did trace route see the result

[dingjerry_FTNT]

In WireShark, it has the TCP or UDP and the port number info. 

For now, the trace route does not help us at all.

[kenorj5]

"Poll AD" tries to read login events from the event log.... There are frequent complaints that it misses login events. It's not FortiGate specific, any brand of firewall that attempts to read event logs will have the same problem (including Meraki and Palo Alto).

[Hemin88]

Hi @okorosylvester 

Could you make sure you have the set up the collector correctly, IP address and port.
Would you mind sharing the screen shot of the Agent settings. 

Following the below steps might help as well:
FortiGate Single Sign On: FSSO » Network Interview

[pminarik]

Can you check who is listening on TCP/8000 on that server? (if anything at all)
Using the command prompt:

> netstat -aon | findstr 0.0.0.0:8000

This will output list of processes that listen on this port. The rightmost value will be the process ID (PID). Replace the xxxx in the below command with the PID to identify the process. (repeat if there is more PIDs).

> tasklist /fi "pid eq xxxx"

[okorosylvester]

Result from the above scan on the server

[pminarik]

That is the expected output, so that's good.

What about the local firewall on the server? (either the builtin Windows firewall, or some third party, if installed) Any chance the traffic is blocked by that? Especially the builtin Win firewall is a common cause of this traffic failing.

[okorosylvester]

I have open all ports on the firewall like 8000,8001,8002 so which other firewall rule is blocking it if u can message me via mail i could show u via google meet sylvestererios@gmail.com

[pminarik]

To be perfectly honest, I have a bit of a PTSD relationship with Windows Firewall and don't trust it much. Are you willing to try a quick test with the Windows Firewall fully disabled temporarily? That should be a sure-fire way of establishing if we can blame it or not. :)

I suppose you could also try to telnet on localhost to the FSSO port.

> telnet 127.0.0.1 8000

That shouldn't be blocked by any default win-firewall rules, as far as I know.