FSSO DC agent show user logon with wrong IP address

[thitinon]

We have FortiGate-200F with Firmware 7.2.5 at HQ

Our office have 4 site. Every site have 2 AD server. We install FSSO DC agent on every server.

Main server at HQ can monitor on other server normally.

But we have problem with 1 user that show correct user but wrong IP address in FSSO DC agent.

It show user: Cxxxxxx , IP: 192.168.0.109

but the correct was user: Cxxxxxx , IP: 192.168.0.127

We have try de-authentication from Fortigate and restart client laptop but FSSO DC agent still show wrong IP address

Please advise how can we solve this issue.

[saneeshpv_FTNT]

Hi @thitinon ,

Could you enable debug logs on the DC agent (On the Server where user authenticate) and see if you could find some relevant information related to this issue.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-logging-on-DC-Agent-FSSO-DC-...

You may use SET command or run "echo %LOGONSERVER%" to identify the DC on which the Users PC authenticate. 

Once the data is capture and still you unable to identify the reason, I would suggest you open a case with Support.

Best Regards,

[rbraha · Accepted solution]

Hi @thitinon 

Does the user after logs in is doing any RDP to another PC?

Make sure that your DNS server resolved correct wks.name to ip,you can do nslookup wks.name and check which ip it has taken on your end user PC.

Additionally you can check DC Agent logs and also you can set on Collector Agent Logging Level to Debug and increase the size to 100MB, try to logout/login with that users and check on both logs when an new event  is generated for that user and any errors related.

[thitinon]

@rbraha 
Thank you.

We have check and found that someone has fix Hostname with IP: 192.168.0.109

Now it work normally.

[pavankr5]

Hello @thitinon,

Ensure that the DHCP server or static IP configuration on the client matches the correct IP address (192.168.0.127). the DC agent might cache information. Try clearing the cached data on the DC agent to see if it resolves the issue. Let me know if FSSO CA the workstation's status "OK" or "Not Verified".

Thanks

Pavan