FSAE Authentication

[ciscokid1903]

We have recently setup the integration with our Firewalls to AD with FSAE. However, this doesn' t seem to be authenticating all users correctly all of the time. For example, within the logs I can sometimes see the authenticated user browsing the internet but sometimes it only shows as guest - this changes without the user logging off or anything. Could someone explain how the FSAE authenticates and logs user activity? Where does it take the user information from etc? Eventually, I would like to resolve the issue and use the FSAE to assist with policy creation to block unwanted users from accessing the internet... first off I would like to get a better understanding of how the FSAE is meant to work.

[#2]

Hi Cisco, I am experiencing the same thing, but I am running e-Directory. I can be logged in to my PC and browsing the net and in the middle of a session authentication fails and I default to a guest status. This should not be happenning. It make it very difficult to configure rules for specific users when authentication fails. I have a support request open so if I get a good answer I will let you know the result. I am also getting errors on the server from the FSAE agent itself.

[billp]

Not a solution, but some related information for you. . . I' m also using FSAE with edirectory. The FSAE agent tends to give off errors on the server. Don' t know why. Have not been able to solve. Others have reported the same issue (search forums for fsae), but seems to continue to function OK. I don' t use non-authenticated guest access, so have not seen the issue you' ve mentioned. Guest users need a guest password for a web login on my network. What firmware and FSAE version are you using? Once authenticated, the Fortigate needs to periodically re-authenticate the user if it hasn' t seen any traffic from that user. If that re-authentication fails, my guess is that it reverts security to Guest (unauthenticated). The trick is to find out why the re-authentication is failing. My advice would be to change your authentication timeout temporarily to something like 2 hours to see if that has any affect. If so, then at least you' ll know you' re on the right trail. The setting is in User|Options. If it' s any help, you can also use the CLI to set specific timeouts for different groups. My guest logins reauthenticate every 15 minutes. But my FSAE logins are much longer -- typically just people logging in for the day at their own desktops. No need to constantly reauthenticate those. Bill

[#4]

Unfortunately I can' t set the time that high. I work for a school district where I have different people logging in to the PC' s all the time. I could increase the time out from 2 minutes to 15. I just saw your post on setting the groups for longer timeout times. That will be usefull for some users. I just don' t understand why I am getting a failure at all. I have 3 LDAP servers configured and 2 FSAE servers configured. Both of which are getting the annoying failure and restart of the service, which I think may be related to my authentication failures. If the service is failing when authentication is occurring authentication will fail. I am running 4.03 build 106 and have tried both of the latest FSAE e-Directory agents.

[billp]

FWIW, I found this document on FTG site under the title " FSAE Users Appear to be logged as guests" [link=]http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=13149[/link] On the edir issue, I found I had fewer errors when using Native mode instead of ldap. I' m also experimenting with limiting the groups that it scans. We have a ton of groups, and it seems to monitoring all of them. FSAE documentation is not great, at least for the edir agent. Bill

[ciscokid1903]

Thank you Bill and Russ for your replies. I have been testing some things and don' t seem to be getting any FSAE errors on my DCs... The problems seem to start when an application on the computer requires a different login name. e.g. the user logs in to the computer with domain account john.smith - authentication will work and show him as john.smith in the logs. Then after a while if user John smith logs in to something like msn messenger as something else like smithie88 - the authentication fails and the log is recorded as guest. This also seems to be effected by scheduled tasks running as different users. so maybe changing the time period to a shorter time may in fact work better in my situation??... It would be nice to know exactly where the data is taken from by the fsae ad integration and if it could be changed.

[rwpatterson]

There is a setting (look for the ' Set Ignore User List' button on the bottom right) on (at least the AD version) where you can ignore logins from certain users (like power users for software install). This should alleviate this type of headache. Our push software requires elevated login status to install, so we ignore this one login, and all is well so far. We have been using it for over two years. FSAE version 3.5.038

[ciscokid1903]

Thanks Bob, the ignore list seems to be working. This command helps to troubleshoot a little as well.... diag debug authd fsae list If you view the log output from putty you get a clearer picture of what accounts have authenticated against the DCs.