FSSO Multiple DC's HELP

[jamacouve]

Hey guys, 

So this client has 5 sites. Each have their own AD and DC and Fortigate.

All sites are interconnected with IPSecs creating a hybrid mesh.

The windows side is a bit weird as when people log on they are not being authed against their local DC.

I cannot for the life of me get the FSSO working. I have installed DC agents on all devices and there is one collector agent.

How should this be set up ? 

Should each firewall point to its DC agent or should they all point to the collector agent ?

[sdue]

All dc have agents installed and pointed to collector? then the fotigate should point to collector. 

[xsilver_FTNT]

Hi,

maybe you should first figure out where is the issue. Is the user seen on Collector ? on FortiGate ?

Chain is that DCAgents talk to Collector Agent which talk to FortiGates.

So work this from source Workstation to DC to Collector and finally to FortiGate.

And that should give you ide where the issue appear. Skip unnecessary steps. So for example if you have the logon with correct groups on Collector and not on FortiGate, skip all checks till Collector and focus on Group Filter. As if you see  logged on user on Collector and not on FortiGate, user did not matched the filter and was not pushed to FortiGate.

From the start :

- what is "echo %logonserver%" result on workstation ? This is the server where %username% authenticated itself (DC)

- is on that DC DCAgent ?

- did the DCAgent seen the logon and reported to Collector ?

- check DCAgent config and see where it points to (Collector(s)), turn on logging if needed

(?) WHERE TO Check ? In registry. Which registry ? Export config from Collector and have a look into file, as the HKLM links to respective registry records are exactly there.

- So maybe DCAgent seen logon, processed it to Collector - > what is on Collector ?

- turn on log to debug level, size 50MB and check. Did DCAgent reported to Collector.

- is the user seen on Collector ?

- did Collector gathered IP from DNS or from DCAgent

- did Collector gathered user's group membership from LDAP ?

- does the group membership match any Group Filter to any FortiGate ? (because if not, the user is useless to process as none of the FortiGate will utilize such record).

- finally, is the user on FortiGate and does he match to any fsso-type user group used in policies ?

- helpful commands

        diag debug reset         diag debug en         diag debug authd fsso server-status         diag debug auth fsso list         diag fire auth list         diag wad user list

best regards,

Tomas

[jamacouve]

xsilver wrote:

snip

Thanks Tomas. 

So the issue doesnt seem to be the collector picking up users logging on.

I have relooked at the design and set it up in the following way :

All 5 domain controllers have DC agents and 2 of them have collector agents.

I am trying to point all 5 Fortigates to one collector agent as a start (Can worry about redundancy later)

So the site A's Fortigate points to site A's collector agent and FSSO is working fine there.

Site B is also pointing to site A's collector agent however there seems to be some sort of comms issue as the FSSO status does not go green. The test from User>LDAP Servers works but Single Sign On stays with the red cross.

I have checked the firewall on site A's DC and it is off. All policies for traffic traversing the firewalls do not have port restrictions so traffic should be allowed.

From site B I can ping site A's DC but the FSSO wont work. Site C,D and E are the same as site B.