FSSO groups

[MustphaBassim]

Hello Dears

I am trying to block some users to access internet using FSSO policy but it seems not working could anyone advise about that ?

Bests

[MustphaBassim]

Hello dear

it's working really what i did is removed the configration and re did again and it's working really the articul that you shared is the same that i follow it it's very recommended to work with it .

Bests

[AntonyChen]

ok bro, nice to hear this

[Markus_M]

Hello,

fitting debug here:

diag debug console timestamp enable

diag debug app fssod -1

diag debug app auth -1

diag debug app smbcd -1

diag debug enable

should show you which users are actually picked up.

I do recommend using the Agent based polling instead, leaves the FortiGate free for its firewalling job and is more flexible in terms of understanding logon events.

https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-Windows-event-IDs-used-by-FSSO-in...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-FSSO-local-poller-fssod-limitations-compar...

Best regards,

Markus

[Markus_M]

and another note: the firewall user monitor is important. If the user is not there or not correct, the policy objects WILL not work. First make sure the users are listed. If they are, then your firewall can use these groups in its policies.

[AntonyChen]

That's right, ad polling mode take high resource on the firewall if your site has lot of concurrent users. Use fsso-agent mode is recommended.