Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
yeowkm99
Contributor

FSSO group is not showing anything

We noticed that the FSSO group is not showing any members although it show there are 20 groups.

my FortiOS is 7.2.7. is there anything wrong with my FSSO setup ?FortiGateFSSO.jpg

11 REPLIES 11
AEK
Honored Contributor

According the the screenshot I guess you mean LDAP tree navigation (not FSSO).

  • Did this worked before the upgrade to 7.2.7?
  • Which LDAP type and version?
  • Have you tried to remove the LDAP server config from FG and put it back?
  • Did you test user credentials successfully under LDAP Servers config?
AEK
AEK
yeowkm99

We upgraded our FortiOS to 7.27 in end Feb and since middle of March, groups.jpgwe have users reporting intermittent issues with Internet connection.

Checking the traffic logs shows that their authentication with AD seems to be failing. 

smaruvala

Hi,

 

It shows 20 group selected but does not show the name of the group even though there is a green tick mark which indicates the selected group. Can you check if you are seeing the correct configuration in CLI?

#config user group

#show

 

Regards,

Shiva

yeowkm99

i can see the initial group of 18 in the CLI, which is not showing in the GUI.

we added 2 for testing yesterday which we can see in the GUI.

is this related to FSSO agent in our AD?

smaruvala

Hi,

 

- May be reconfiguring the group should solve the issue in which you are not seeing the groups in GUI. It could be a GUI issue as we can see the configuration in CLI.

- As per my understanding your main issue here is related to internet communication. You mentioned that the communication to AD is failing. Does the firewall has the IP-User group mapping for the IP which does not work. You can run the command "diag firewall auth list" to see the mapping.

- Does the FSSO agent has the log on event and information related IP and user group?

 

Regards,

Shiva

yeowkm99

have tried re-adding 3 groups to the list. 

first 3 in the attachment is from original list, the next 2 is what we have just added.

the firewall do have the ip-user group. 

when user have Internet issue, we noticed that the uesrname if missing from the traffic logs.adgrp.jpgScreenshot 2024-03-20 174412.jpg

bpozdena_FTNT

The  ID and Name fields under the Selected LDAP filter are blank because your adgrp names are not in a valid LDAP DN format.

 

For example, "**** FULL ACCESS TELECON" or "****RL NO ACCESS" are not valid LDAP DNs, therefore the ID and Name can't be resolved over LDAP and the fields remain blank.

 

This most likely happened because you at some point decided to switch FSSO User group source from "Collector Agent" to "Local". This used to be called Standard or Advanced mode on FortiOS 5.6 and older.

 

Since your FSSO Collector Agent is still switched to "Standard mode", you should configure the FSSO Fabric Connector to use "Collector Agent" as the User group source again. The group filters will then be configured on your FSSO Collector agent as in the past.

 

You can also read the below KB, which explains it in more detail:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-switch-FSSO-operation-mode-from-Sta...

HTH,
Boris
yeowkm99

yes, the user group souce is now set to Local in GUI.

I don't see this setting in the CLI.

is this only available in GUI ??

bpozdena_FTNT

Enabling the "local" option in the GUI just allows you to use the GUI LDAP browser to easily create entries under "config user adgrp". You can create these entries manually in the CLI regardless of the GUI settings.

 

The main problem in your case is that your FSSO Collector is set to "Standard" mode,  which uses group names in format "DOMAIN\GROUP". While your Fortigate is configured in the Advanced mode, which uses group names in format "CN=group,DC=domain".

 

 

HTH,
Boris
Labels
Top Kudoed Authors