FSSO Issues

[yesowemm]

I am having issues using my FSSO on my Fortigate 1000D. I have connected my to my LDAP and i am able to pull all my users. 

But when i try using my FSSO, my status is disconnected even though i am using the same password i used for the LDAP polling.

My firmware is 5.4.5. I have tried using both the Polling Active Directory Server and the Single Sign-On Agent. Can someone help me resolve this issue?

[ipns]

To use FSSO u need a FSSO agent on one of your Domain Controllers.

Did you install it?

http://cookbook.fortinet....-advanced-mode-expert/

[yesowemm]

I have installed the Agent on the Active Directory and Configured it. My issue is that the Fortigate SSO after configuration still has the status to be disconnected. Even though i have the same password configured both the Agent and on the Fortigate

[AtiT]

Hello,

Do you have TCP/8000 port open on the machine where the FSSO Collector Agent is insalled?

Can you do sniffer packet whether there is a communication on the TCP port 8000?

Do you see heartbeat from the FSSO Collector agent issuing the commands:

diagnose debug reset

diagnose debug application authd -1

diagnose debug enable

--- you should see something: _event_read[name_of_the_fsso_object_on_fortigate]: received heartbeat 113502

Can you check the FSSO Collector Logs for error messages? Also you can try to set the debug level to info and check whether you something like: 1 FortiGate connected

[Fullmoon]

dealt with same issue before, the problem was the account we were using has no Administrator rights ;)

[hawada]

Hello,

To test your LDAP object and see if it's working properly, the following CLI command can be used: 

FGT# diagnose debug enable FGT# diagnose debug application fnbamd 255

FGT# diagnose test authserver ldap <LDAP server_name> <username> <password>

Where <LDAP server_name> = name of LDAP object on Fortigate (not actual LDAP server name!) For username/password you may use any from the AD,  but it is recommended (at least at the first stage) to test credentials you have used in the LDAP object itself. If this credentials will fail then any other will fail as well as the FortiGate will not be able to bind to the LDAP server.

to stop this debug type:

FGT# diagnose debug application fnbamd 0

[xsilver_FTNT]

LDAP is not FSSO, regardless you can use LDAP on FGT to select groups on AD to be included in Group Filter for that particular FGT unit.

Password on FSSO Agent in FGT has to be same as the password used in Collector / Authentication / 'Require authenticated connection from FortiGate'.

It usually is but do not need to be same as password of the account under which the Collector runs.

As mentioned many times in docs and others, Collector has to be installed under Domain Admins group member account and it's hardly recommended to also run the Collector under such account. Regardless it's possible to strip down the access rights of the account under which Collector Agent runs.

If still see disconnected in 'diag debug auth fsso server', then ...

Sniff on port 8000 as FGT tries to connect to Collector on that port.

Check if any FGT is seen by Collector.

Check firewall on DC.

Switch collector log to debug level and check it, it might happen that shared password was not typed same and so collector will complain that FGT is trying to connect but password is not matching.

Regards,

Tomas

[silviup]

Howdy!

You do not use Windows Agent since 5.0 OS.

On the single sign on configuration please make sure you add a user with administrative rights because I suspect it is using WMI to check the User-IP corespondence.

While LDAP user can be a limited rights user - on the SSO it should be admin or you can try and configure rights for WMI in WMI snap-in.

HTH