We've been running FSAE/FSSO collector agents on our DCs for some time and everything seems to be working just fine in terms of user authentication in the firewall.
But I have noticed DCOM errors in the Event Log on the main DC, such as the following:
Event ID = 10028
Source = DistributedCOM
Message = DCOM was unable to communicate with the computer 10.20.30.40 using any of the configured protocols; requested by PID 999 (C:\Program Files (x86)\Fortinet\FSAE\collectoragent.exe).
Investigations of the IP Addresses reported show that these errors occur in 2 specific scenarios:
(1) when one of our Fuji Xerox printers is used by a staff member to Scan a document which is saved to an SMB File Share on a server (there is a domain user account used by the printer to authenticate access to the share); or
(2) when our Barracuda Message Archiver checks user mailboxes in Exchange to synchronise the list of mailbox folders (this runs under a specific domain user account each evening)
I have tried excluding the 2 x domain user accounts used by those processes, so that the collector 'ignores' them. This has NOT fixed the Event Log errors.
Q. is there any way to tell the Collector to ignore specific IP Addresses on the network? (there is no point it trying a DCOM connection to the BMA or to a Printer).
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Yesterday I added the long string of extra IPs.
Rebooted the DC overnight.
Today the Event ID 10028 errors for the IPs that were excluded are continuing.
I don't know what else to try.
I'm running FSAE v5.0.0287
Hello Frosty,
Sorry to hear that. I suggest technical ticket for this.
Best Regards,
Alivo
livo
I may do that when I have some spare time, but am too busy right now.
We noticed some odd side effects, with staff losing Internet access.
I suspect that FSAE/FSSO was performing poorly due to the large number of excluded IPs.
So for now I have reversed the changes and am living with Event Log errors instead.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.