Agent based FSSO and multiple/concurrent logons into different workstation

[Vasiliy]

Hello!

I use FGT-60D and FSSO. I have ADUser1 logon on Workstation1 and the same user logon on Workstation2. On Workstation1 user have internet, on Workstation2 it don't have internet. But the worth thing it work well a couple days ago! All that i change is Windows Update install on FSSO server. But, is there any setting in FSSO or, maybe, device itself, that can help me to have internet for all users at all PC's at the same time? Because now users have internet only on one PC (where was first login).

[Vasiliy]

Forget to say, i use Explicit Proxy!

[xsilver_FTNT]

Hello,

check the Collector log, maybe it contain reason for secondary workstation issue.If still no clue then I'd suggest to follow bellow mentioned plan and open ticket on Fortinet support with those collected data.

Then we can analyze it and provide insight to what happened and why.

Kind regards, Tomas

Recommended steps: ------------------ A. Preparation     A.1. What is used FSSO/FSAE version (Collector Agents, DCAgents)     A.2. A copy of Collector's exported config            A.3. Export of auth registry from all DCs (if DCAgent mode is used)         Auth:         [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0]         (should result in "auth0" = "dcagent")           [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos]         (should result in "auth0" = "dcagent")     A.4. Network Topology information for polling modes (incl: numbers of DCs)     A.5. FortiGate’s current config and debug.log files         Debug.log is reachable in GUI : System > Config > Advanced > Download Debug Log         in Cluster it's reachable for every cluster member under GUI: System > Config > HA > right side click the arrow-on-page icon "Download Debug Log".     A.6. Switch the Collector agent’s logging level to the Debug level and switch the log size to 50MB, on all Collector agents. B. When the issue occurs, collect the following information:     B.1. copy of log file from all Collector agents     B.2. Workstation’s output under affected user account         ipconfig /all         echo %logonserver%         echo %username%         net use         time /T         date /T     B.3. on FortiGate collect output of those commands (fsso=fsae naming varies in firmware versions)         get system stat         diag debug reset         diag debug en         diag debug authd fsso server-status         diag debug auth fsso list          B.4 take a screenshot or note what IP was printed in bold (active collector) in "FSSO Agent IP/Name" column on GUI / User & Device / Authentication / Single Sign-On

[Vasiliy]

C:\Program Files (x86)\Fortinet\FSAE\CollectorAgent.log

Have only one error message: 02/26/2016 14:15:12 [ 3168] ldaplib::ldap_bind_s failed, server:192.168.1.1 error code:0x31.

Agent Version: 5.0.0241

But everything works fine, except concurrent sessions. All other things i checking now. Thanks!

[xsilver_FTNT]

crucial part is that you should have record for both workstation source IP (and I assume that those workstations has different IP) in FSSO list with same user/group data. Something like :

FG10CH-1 # diag debug authd fsso list
----FSSO logons----
IP: 172.31.18.23  User: ADMINISTRATOR  Groups: CN=DOMAIN USERS,CN=USERS,DC=GOGO,DC=EXAMPLE,DC=LOCAL

IP: 172.31.18.42  User: ADMINISTRATOR  Groups: CN=DOMAIN USERS,CN=USERS,DC=GOGO,DC=EXAMPLE,DC=LOCAL

Total number of logons listed: 2, filtered: 0 ----end of FSSO logons----


If you have that, then it will be firewall policy source/dst + groups issue.
If you don't have secondary record you have to check collector, do you have it on collector in logon user list ? no? then check log for reasons

[Vasiliy]

Ah! You mean "Show Logon Users" in Fortinet Single Sign On Agent Configuration. Yes, it show all users correct!

But strange! Today morning all works well! Without any changes from my side! Very strange device work! Very!

[xsilver_FTNT]

if all expected users are on "Show Logon Users" in Collector, but not in FortiGate, then filters are not set correctly (most usual case). As Collector will report only subset of the users according to filter set for particular FortiGate. If FortiGate logged to Collector do not have its own filter then Global filter will be used.

FSSO Collector heavily depends on LDAP , DNS and underlying OS. Therefore similar "strange" situations are not rare, but rarely caused by Collector itself. More often it's misconfiguration of some parts (Collector-FortiGate filters, MS Audit, user rights etc.).

In case of continual troubles I'd suggest to open a ticket on Fortinet support.