Advantages of FortiAuthenticator as an FSSO Collector Agent?

[Bruce7x2]

Dear Sir,

I would like to know when FortiAuthenticator serves as the FSSO Collector Agent, Windows Server does not require the installation of FSSO Agent.

What are the advantages of adopting this approach?

[ebilcari]

In this case FortiAuthenticator will poll directly the Domain controllers for events. It may be easy to setup but it doesn't scale well if the number of Domain controllers will increase over time. Having the Collector agent installed together with the DC agent is recommended, some info are shown here: https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-FortiAuthenticator-FSSO-with-DC-A...
FortiAuthenticator offer many other possibilities to collect different types of information and create FSSO like from RADIUS, syslog etc.

[Bruce7x2]

Dear ebilcari,

According to your mention of "It may be easy to setup but it doesn't scale well if the number of Domain controllers will increase over time," could you provide me with a specific description?

From what it appears, using FortiAuthenticator as an FSSO Collector Agent might not be a good practice. Is this correct? Or are there specific scenarios where using FortiAuthenticator as an FSSO Collector Agent is recommended?

[ebilcari]

There are some Windows events that need to be polled in order to extract the information and build the FSSO. This events are shown here: https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-Windows-event-IDs-used-by-FSSO-in...
So this procedure, reading and extracting the information can be done by the Collector Agent or FAC. There is also a DNS checkup to convert the workstation name to the host IP. So in case you have 2 DC for example and don't have access to install any software (DC or Collector agent) you can use the polling directly from FAC. In case you have ~100 DCs, FAC has to poll for events on all the servers and depending on user activity this may cause latency or missing FSSO. Using DC and Collector agents is the recommended solution in cases where you are allowed to install software in DCs.

[pminarik]

Your responses sound like you don't know that FAC can use DC Agents.

Are you aware of this? (the first KB you linked to shows how to use FAC with DC Agents)

[ebilcari]

Yes, I'm aware of it but if the customer can install the DC agent on every DC it can also install the Collector in one of them. We are just discussing polling mode vs DC/Collector agents installed in DC.

[Bruce7x2]

Dear ebilcari,

Changing the question, in today's architecture where FAC serves as the collector and AD installs DC Agent, the benefits of the design I listed are as follows. If there are any additional benefits, please let me know.
1. Reduces the system resources burden on AD when serving as the collector.
2. FAC integrates user login activity messages, providing richer alert information and facilitating auditing.

Additionally, could you provide information about the CPU/Memory requirements for FSSO Agent and DC Agent?