FSSO Groups not available in Users & Group

[fmahe]

Hi All, On our FG300C with FortiOS 5.0.6, we are not able to see the Groups defined in the FSSO Agents installed on our DCs. Fortigate is connected to the agents and in Log & Report -> Event Log -> User, we are able to see the users that are connected, however, group is still empty. With the cli, FW-FR1-01 # diagnose debug authd fsso list ----FSSO logons---- IP: X.X.X.X User: U1 Groups: DMN/CFS_DEFAULT Workstation: WKS1.DMN IP: X.X.X.X User: U2 Groups: DMN/CFS_DEFAULT Workstation: WKS2.DMN IP: X.X.X.X User: U3 Groups: DMN/CFS_DEFAULT Workstation: WKS3.DMN IP: X.X.X.X User: U4 Groups: DMN/CFS_DEFAULT Workstation: WKS4.DMN IP: X.X.X.X User: U5 Groups: DMN/CFS_DEFAULT Workstation: WKS5.DMN IP: X.X.X.X User: U6 Groups: DMN/CFS_DEFAULT Workstation: WKS6.DMN IP: X.X.X.X User: U7 Groups: DMN/CFS_DSI Workstation: WKS7.DMN IP: X.X.X.X User: U8 Groups: DMN/CFS_DEFAULT Workstation: WKS8.DMN Total number of logons listed: 8, filtered: 0 ----end of FSSO logons---- DMN/CFS_DEFAULT & DMN/CFS_DSI are part of the group allowed in the FSSO Agent and the objective is to define a browing policy based on Content Filtering Group. As these groups are not present in Users & Devices -> User -> User Groups when we define an FSSO Group, users are not able to browse anymore. Any idea to solve this issue? Regards

[TechnoR05]

Hello, I would first ask if this worked before and stopped working after an upgrade ? We have a 1000C with FSSO Collector on a separate VM, so I will give you my opinion, but if your setup is different it might not apply. The command on our Fgt shows more information, as : IP: X.X.X.X User: U2 Groups: <DOMAIN_GROUP> Workstation: X.X.X.X MemberOf: <FortigateGroupName>. If you go to Users & Devices -> Single Sign-On, and you Edit your Single-signon server, you should see the domain groups, that is the groups that exit on your DCs, under Users/Groups ? Under Users & Devices -> User -> User Groups, I believe you should see the groups you created on the Fortigate, into which you would put your domain groups, if you can see them, eventually. Hope it helps you to go further !

[fmahe]

Hello, No, we start the setup after the upgrade in 5.0.6. The FSSO Collector is setup on our DC, and we use Fortimanager to manage our 60 FGT (60C, 100D & 300C). From the GUI of the 300C, everything is OK and after an import in our Fortimanager, we are able to see everything from our DC. So the issue seems to come from the Fortimanager who is not able to get the information from the Agent... Thanks & Regards Franck

[TechnoR05]

Hi, I am not familiar with Fortimanager, so maybe you' d be better off opening a ticket with Fortinet for that part, but I believe the group contents are sent from the Agent to the Fortigate directly, so the Fortimanager would normally not get any information from the Agent. And you should be able to configure everything without the Fortimanager, at least on one machine, even if just to prove it does work. Still you mention that " From the GUI of the 300C, everything is OK " , however you also mention that " On our FG300C with FortiOS 5.0.6, we are not able to see the Groups defined " ... I probably do not understand correctly what the problem is. In Log & Report -> Event Log -> User, you see the users that are part of groups that you configured the FSSO Agent to send to the Fortigate, so we can assume that the Agent sees the AD Groups and their users, and sends this information correctly. The way I see this, from the output of " diagnose debug authd fsso list " , it seems to be missing the last part that we get on our machine, " MemberOf: <FortigateGroupName>" , as if the groups on the Fortigate do not contain the groups from your DC/FSSO Agent When you create a group on the Fortigate, you do specify the type FSSO ? Do you have a LDAP server specified under Users & Devices -> Authentication -> LDAP Servers, with a bind type Regular, port 389, and Common Name Identifier of sAMAccountName, etc ? Let me know if this is too garbled or anything else I can do :) Richard