We have FortiGate-200F with Firmware 7.2.5 at HQ
Our office have 4 site. Every site have 2 AD server. We install FSSO DC agent on every server.
Main server at HQ can monitor on other server normally.
But we have problem with 1 user that show correct user but wrong IP address in FSSO DC agent.
It show user: Cxxxxxx , IP: 192.168.0.109
but the correct was user: Cxxxxxx , IP: 192.168.0.127
We have try de-authentication from Fortigate and restart client laptop but FSSO DC agent still show wrong IP address
Please advise how can we solve this issue.
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi @thitinon
Does the user after logs in is doing any RDP to another PC?
Make sure that your DNS server resolved correct wks.name to ip,you can do nslookup wks.name and check which ip it has taken on your end user PC.
Additionally you can check DC Agent logs and also you can set on Collector Agent Logging Level to Debug and increase the size to 100MB, try to logout/login with that users and check on both logs when an new event is generated for that user and any errors related.
Hi @thitinon ,
Could you enable debug logs on the DC agent (On the Server where user authenticate) and see if you could find some relevant information related to this issue.
You may use SET command or run "echo %LOGONSERVER%" to identify the DC on which the Users PC authenticate.
Once the data is capture and still you unable to identify the reason, I would suggest you open a case with Support.
Best Regards,
Hi @thitinon
Does the user after logs in is doing any RDP to another PC?
Make sure that your DNS server resolved correct wks.name to ip,you can do nslookup wks.name and check which ip it has taken on your end user PC.
Additionally you can check DC Agent logs and also you can set on Collector Agent Logging Level to Debug and increase the size to 100MB, try to logout/login with that users and check on both logs when an new event is generated for that user and any errors related.
@rbraha
Thank you.
We have check and found that someone has fix Hostname with IP: 192.168.0.109
Now it work normally.
Hello @thitinon,
Ensure that the DHCP server or static IP configuration on the client matches the correct IP address (192.168.0.127). the DC agent might cache information. Try clearing the cached data on the DC agent to see if it resolves the issue. Let me know if FSSO CA the workstation's status "OK" or "Not Verified".
Thanks
Pavan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1688 | |
1087 | |
752 | |
446 | |
227 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.