In our office network, we make use of fortinet FSSO to control Internet access per individual user.
After we login, our AD username and IP address will be logged by our firewall before we are able to access Internet.
We noticed that some times when user go to different office, their IP address will change.
eg. from office 1, PC01, 172.20.0.84 change to office 2, PC01, 172.30.0.74. If the AD DNS record does not update the hostname to the new office address PC01, 172.30.0.74, the user will have issues accessing Internet as the firewall log will only show 172.30.0.74 instead of username(172.30.0.74).
the quick n fast way for us to solve this is do a ipconfig /renew or restart the PC, so that user will get the new IP address.
Is there any way to resolve this issue ?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi yeowkm99,
Can you please check on the FSSO collector agent under advance setting -> Windows security events logs . By default it will be 0, can you try changing the same to 2 as per the below KB.
Regards,
Patterson
currently set as 0. have change it to 2.
i saw event ID 4624 and 4634 in the event logs.
how does changing this value effect the user logon
Hi,
Changing the polling ID will help the agent to collect more security event ID, Agent requires workstation name on a security event to update the change in IP, Ideally Kerberos as the authentication will not have the workstation name, so the agent use a combination of event ID like 4768, 4769 to collect the workstation name.
after changing the value to 2, i still have users with the same issues.
DNS record not updating when they switch to different location.
I need to remove the older record in the DNS manager in my AD server. only after i remove the old DNS record, then they can access Internet.
i have more than one FSSO collector agent servers.
have since changed the values on all the servers.
Hey yeowkm99,
what IP verification do you have set up in collector agent? you could lower the time; this causes Collector Agent to double-check workstation IPs more quickly (and it should thus detect IP changes more quickly).
However, the main issue is likely something like this:
- Collector Agent checks one DNS server (based on the host's system settings)
- a host that changes its IP reports the IP change to a different DNS
- it takes a few minutes for the change to be replicated through your AD environment
A workaround could be for users to sign out and sign into their workstations again; this would generate a login event that Collector Agent should pick up on pretty quickly. As long as the login event is generated with IP, Collector Agent will see that. If the login event is generated with workstation name again, however, the issue with DNS lookup still remains.
The only real fix is something like Mobility Agent (which is a tool that reports IPs automatically to FortiAuthenticator, used in VPN scenarios), or make sure DNS changes in your AD are replicated more quickly so Collector Agent can pick up on the changed IP more quickly.
where do i lower the times ? is it at the collector agent ?
You should have an IP address change verify interval in Collector Agent (near the bottom):
You can lower this, so Collector Agent checks DNS server more frequently, but it won't change anything if the entries in DNS server are not updated.
how do i make sure that the DNS changes are replicated more quickly ?
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1641 | |
1069 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.