FSSO DC agent cannot get DNS name of domain

[aousien]

Hello , 

I have DC agent installed on the Domain Controller, and FAC debug indicate that it's getting the user and workstation details, but that it cannot resolve the DNS name for the workstation domain 

error below from FAC FSSO debug ( FAC is acting as collector agent )

any ideas or tips on where to look?

the workstation domain name is like mydomain.subdomain.local, so I have added subsomain.local to the DNS suffix in the DC agent config page, but still with no luck. appreciate anyone's help. Thanks

01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: decoded workstation: WKS01
01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: decoded domain: MYDOMAIN
01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: decoded user: userx
01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: has 0 ipv6 address
01/21/2022 15:32:04 [F4555555] DC/TS Agent [WARN]: cannot get DNS name of domain MYDOMAIN from Domain Manager
01/21/2022 15:32:04 [F4555555] DC/TS Agent [WARN]: Failed to decode DCTSA packet from 10.119.216.31:56581

[Sx11 · Accepted solution]

Hi,

what events do you get from the Domain Manager debug logs?

You can check at https://<FortiAuthenticator-IP-Address>/debug

On the top left services select FSSO Domain Manager.

Check the timestamp to see events that correlate to the events in DC/TS Agent service.

When you select "FSSO Domain Manager" service you also get a function on the GUI named "Rebuild SSO domains". If you enable this it will generate new events related to the status of the Domain Manager and you could get more information on the issue.

More information on troubleshooting here:

https://docs.fortinet.com/document/fortiauthenticator/6.0.7/administration-guide/120058/debug-logs#D...

Regards,

S

[clisecure]

I am getting an error like the one below and I haven't found a solution.

10/04/2024 23:55:36 [F23946C0] FCT LOGON 2024-10-04-23:55:36/1970-01-01-00:00:00 FortiClient (null):DESKTOP-21111.XXX.COM/10.13.0.48 XXX.COM/ENTRATESTUSER1
10/04/2024 23:55:36 [F23946C0] Exclusion List [DEBUG]: Looking up user ENTRAUSER1 [3,-1] in exclusion table
10/04/2024 23:55:36 [F23946C0] FCT 10.13.X.X: SSOMA UUID: 100951064CXXXXXXXXXXX EMS S/N: (null) EMS tenant ID: (null)
10/04/2024 23:55:36 [F23946C0] FCT 10.13.x.x: cannot get DNS name of domain XXXXX.COM from Domain Manager
10/04/2024 23:55:36 [F23946C0] FCT disconnected: 10.13.x.x

[Debbie_FTNT]

Hey clisecure,

based on the log snippet, it looks like the following is happening:

-a FortiClient or FSSO Mobility agent is reporting a login to FortiAuthenticator with a workstation name DESKTOP-21111.XXX.COM

- FortiAuthenticator looks for the domain XXX.COM but doesn't find it

-> if you check under Monitor > SSO > Domains, you can see what domains FortiAuthenticator is aware of, including DCs

-> the domain XXX.COM should be listed here if FortiAuthenticator is able to discover it via LDAP lookups

-> if the domain is not listed here, then FortiAuthenticator is not aware of it and cannot process FSSO logins for it

-> in that case, adding a remote LDAP server for that domain should help

[clisecure]

Hi Debbie

Thanks for your answer.

When I check  Monitor > SSO > Domains I can see only local AD showing. However, all the end-user PCs joined Azure AD, so I have to push them to search for users on remote AD. 

Remote- Auth. The server / OAuth is already configured, but we are still searching from the local AD. How can I  push to search from Remote AD?

[xsilver_FTNT]

Hi aousien,

as you mentioned FortiAuthenticator (FAC) as the collector being listening to DC Agent (installed on AD/DC), then I assume you have FAC / GUI / Fortinet SSO Methods / SSO / General / "Enable DC/TS Agent Clients" enabled.

And so FAC / GUI / Monitor / SSO / "DC/TS Agents" shows your DC Agent connected.

Also .. SSO / Domains shows your AD domain and structure and individual DCs as green.

If that second part (Domain monitor) is not OK, then check <FAC-IP-FQDN>/debug/domain-manager/ log for any connection errors.

Domain manager gets this info from either Fortinet SSO Methods / SSO / Windows Event Log Sources (if you would do DC polling). But as you claimed using DCAgents, then your possible source might be FAC / GUI / Authentication / Remote Auth. Servers / LDAP setting with bond to Active Directory Domain via "Windows Active Directory Domain Authentication" setting inside LDAP server setup.

Properly set up DNS is crucial part of SSO. I just guess that your AD/DC is also your DNS server, but that could be separate server or even non-Microsoft DNS (like Bind).
So another thing to help with resolution is FAC / GUI / System / Network / DNS  having one of set DNS  servers set/pointing to AD/DNS, or your actual DNS server.

Another thing to help is actual DC Agent, as by default it will try to resolve hostnames gathered from logon attempts in LSAS via local OS in which it is installed.
DCAgent hostnames resolution capability is controlled by those self-explanatory registry keys "donot_resolve" and "Domain_DNSsuffix" in [HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FSAE\dcagent] .