Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
thitinon
New Contributor

FSSO DC agent show user logon with wrong IP address

We have FortiGate-200F with Firmware 7.2.5 at HQ

 

Our office have 4 site. Every site have 2 AD server. We install FSSO DC agent on every server.

Main server at HQ can monitor on other server normally.

 

But we have problem with 1 user that show correct user but wrong IP address in FSSO DC agent.

 

It show user: Cxxxxxx , IP: 192.168.0.109

but the correct was user: Cxxxxxx , IP: 192.168.0.127

 

We have try de-authentication from Fortigate and restart client laptop but FSSO DC agent still show wrong IP address

 

Please advise how can we solve this issue.

1 Solution
rbraha
Staff
Staff

Hi @thitinon 

Does the user after logs in is doing any RDP to another PC?

Make sure that your DNS server resolved correct wks.name to ip,you can do nslookup wks.name and check which ip it has taken on your end user PC.

Additionally you can check DC Agent logs and also you can set on Collector Agent Logging Level to Debug and increase the size to 100MB, try to logout/login with that users and check on both logs when an new event  is generated for that user and any errors related.

View solution in original post

4 REPLIES 4
saneeshpv_FTNT

Hi @thitinon ,

 

Could you enable debug logs on the DC agent (On the Server where user authenticate) and see if you could find some relevant information related to this issue.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-logging-on-DC-Agent-FSSO-DC-...

 

You may use SET command or run "echo %LOGONSERVER%" to identify the DC on which the Users PC authenticate. 

 

Once the data is capture and still you unable to identify the reason, I would suggest you open a case with Support.

 

Best Regards,

 

rbraha
Staff
Staff

Hi @thitinon 

Does the user after logs in is doing any RDP to another PC?

Make sure that your DNS server resolved correct wks.name to ip,you can do nslookup wks.name and check which ip it has taken on your end user PC.

Additionally you can check DC Agent logs and also you can set on Collector Agent Logging Level to Debug and increase the size to 100MB, try to logout/login with that users and check on both logs when an new event  is generated for that user and any errors related.

thitinon

@rbraha 
Thank you.

We have check and found that someone has fix Hostname with IP: 192.168.0.109

Now it work normally.

pavankr5
Staff
Staff

Hello @thitinon,

 

Ensure that the DHCP server or static IP configuration on the client matches the correct IP address (192.168.0.127). the DC agent might cache information. Try clearing the cached data on the DC agent to see if it resolves the issue. Let me know if FSSO CA the workstation's status "OK" or "Not Verified".

Thanks

Pavan

Top Kudoed Authors