Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
uhchelpdesk
New Contributor

FSSO, Identity based policy and shared user accounts

We have an issue where a couple of our users occasionally cannot browse the internet. We are using Identity Based Policy without a guest account. I have verified that these workstations do have remote registry turned on. I can connect to the registry remotely. (This was an issue we had on a few of our workstations.) The only thing I can see that the accounts have in common is that they are shared accounts. There are at least 6 or more computers that the same user logs in on. Not all of the computers will have the issue. Typically it is one at a time, but when they do if we log them off then back on again we they can browse the internet again.
8 REPLIES 8
rwpatterson
Valued Contributor III

Welcome to the forums. When these users are unable to browse, can you see that they are authenticated in the firewall? (Look under ' User > Monitor > Firewall' )

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
uhchelpdesk

Yes but not for that IP address. The logs show Authentication user from X.X.X.X was timed out.
rwpatterson
Valued Contributor III

By any chance are you pushing down software during login? If so you may need to exclude that account from FSSO registration.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
uhchelpdesk

We don’t do that with these shared account but we do with almost all of the other accounts. Why does that make a difference? I don’t understand the connection. On the other hand I think we have narrowed the issue to shared accounts with Windows XP os. We don’t see the same issue with our group that uses a shared account and are all on Windows 7.
rwpatterson
Valued Contributor III

When pushing software, that pushed account is seen as being logged in (yes, even after the real user has logged in) while the software push is in place. After the push is done, that account ' logs out' and the login session is shown as terminated. This is why there is an option in the FSSO software to ignore certain accounts.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
uhchelpdesk

Thanks for the clarification unfortunately that’s not the issue we have here. We did verify that when the user is “blocked” from browsing the internet the account/IP address is not listed in the monitor section of the Fortinet nor are they listed in FSSO. I thought that it was the case that they were listed but had the “Not Verified” status but after further review I don’t see the workstation IP/username combination listed in FSSO. Thanks a lot for your assistance.
rwpatterson
Valued Contributor III

Is it based solely on the workstation? What I mean is: can they successfully authenticate from a workstation sometimes, but not other times from the same box?

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
uhchelpdesk

yes it will work fine when a user first logs in then at some point they will be blocked once they are blocked if they lock the workstation then unlock it they can get out again. It acts like it has something to do with being a shared account on XP and some sort of timeout.
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors