Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
filiaks1
New Contributor II

Can the Fortigate Firewalls share user information using FSSO with without Fortiauthenticator?

Hi to Everyone,

 

I am new to the Forti firewalls but I have firewall knowedge and I wanted to ask if the Fortigate Firewalls can share user information using FSSO with without Fortiauthenticator?

 

I see that the FSSO is used to share user to ip maping , groups etc but from what I have seen from the documentation and youtube :) the Fabric Connectors can be the DC agent installed on a windows computer or the Fortiauthenticator but not another Fortigate firewall. Is that right?

 

I want the users to authenticate to the VPN forti firewall and then the other forti firewalls after the VPN firewall to take the user info using FSSO, where the configured connector will be the VPN firewall but as I mentioned I do not know if this is possible.

 

https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/450337/fsso

 

https://help.fortinet.com/fmgr/50hlp/60/6-0-2/Content/FMG-FAZ/1200_Fabric_View/0600_Fabric%20Connect...

 

 

Directly configuring the DC agent as a connector on the firewall:

 

https://www.youtube.com/watch?v=ua0pDsmQKSk&t=281s

 

 

Configuring the DC agent on the Fortiauthenticator and then configuring the Fortiauthenticator as a connector on the firewall:

 

https://www.youtube.com/watch?v=qsHMPeSoA5o&t=155s

 

1 Solution
Anthony_E
Community Manager
Community Manager

HEllo,

 

So here the answer from our FortiAuthtenticator expert:

 

'The answer is no. With the current FortiOS design, the FortiGate can only poll the user info FSSO agent or the FortiAuthtenticator, not from other FortiGate. You can raise a feature request from a local SE or parent'.

 

I hope it is helpful.

 

Regards,

 

Anthony-Fortinet Community Team.

View solution in original post

4 REPLIES 4
Anthony_E
Community Manager
Community Manager

Hello,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Anthony-Fortinet Community Team.
Anthony_E
Community Manager
Community Manager

Hello,

 

We are still looking for someone to help you.

We will come back to you ASAP.


Regards,

Anthony-Fortinet Community Team.
Anthony_E
Community Manager
Community Manager

HEllo,

 

So here the answer from our FortiAuthtenticator expert:

 

'The answer is no. With the current FortiOS design, the FortiGate can only poll the user info FSSO agent or the FortiAuthtenticator, not from other FortiGate. You can raise a feature request from a local SE or parent'.

 

I hope it is helpful.

 

Regards,

 

Anthony-Fortinet Community Team.
filiaks1
New Contributor II

Thanks for the info and I will keep that in mind :)

Labels
Top Kudoed Authors