Good question since I always found that this is not well documented.
You should first read few documentation on FSSO and agent, but I think this will not be enough.
However if you want to make it short, then briefly there are three possible modes:
- DC Agent (must be on DC server) + Collector Agent (no need to be on DC): I think this installation is well documented
- Collector Agent only: No need to be on DC, this is the ultimate method if your if your customer is strict and refuses to install anything on DC
- Polling mode: FGT embedded agent is used, no need to install any other agent
Method 1 & 2 both give very good result (I'd say same result) and should be used in production environment.
Method 3 should not be used in prod env, it can give very bad result for non small env
A good idea for production env is to install DC agent on 2 DC servers, and/or collector agent on 2 separate VMs, for redundancy.
Configuration is a bit long so try take some time to read it and test it in your lab. This is needed to master the thing.
Hope this helps.