FSSO implementation with many locations

[Satay]

Hello,

I'm new in this forum. I've got 1 year experience of managing 20 Fortigate units (20C, 50C, 60B, 60D, 80C, 240D). Now i try to implement FSSO function on 240D Fortigate and I've got some questions about informations that I cannot find in workbooks:

1. Does FSSO function required some licence (without using FortiAuthenticator)?

2. I'm thinking of collector + agents enviroment. I've got 20 FG units in 20 localization placed in hole country. They are connected via MPLS network. I've got centralized AD service placed in one localization and synchronized backup AD service in another. When I analysed this enviroment, i found one problem - Fortigate unit need to have connection to collector server.

- What if my remote FG unit placed in one localization cannot reach Collector server placed in another localization (MPLS malfunction)?

- Does FG with FSSO function cache logins and passwords from AD?

- What if new user wants to connect (via SSO) after MPLS malfunction?

Notice, that I want to create policies based on AD users group (prevent local users from accesing network resources).

Thanks a lot for any informations.

Sebastian

[xsilver_FTNT]

ad1. no extra license needed

ad2.

- for large (network and round trip time point of view) environments I'd suggest Collector with DCAgents

- if you have less faith in network then you can use secondary collector, once is primary one out (FGT cannot connect to it) then FGT will switch to secondary Collector in FSSO Agent config. That secondary is used till it fails, then next in row is used. If only two in config then first one is used again. There is no automatic fall back to previous Collector once it's operation/reachability is resumed, FGT will stay using secondary unit. This scenario is used fro resiliency. BUT! all the DCAgents has to be configured to report to both Collectors. There is no config/data cluster between Collectors, they are independent.

[Satay]

Thanks for reply.

I think You don't understand my question, so I'll try to specify my enviroment:

- I've got 20 localizations all over the country.

- In every localization I've got FG unit.

- In 2 localizations i've got AD controllers (synchronized by MPLS network).

- Every other localizations communicate to AD controllers so they can authenticate users.

- MPLS network give me 1 connector to MPLS network per localization.

And now question:

If my MPLS connector is down (in localization without AD controller) how will FG unit behave (FG unit will not see any server collectors then)?

What about new users that will log into AD (users cridentials on PC's will work without AD controller communication)?

Will FG unit give them access to network resources (policy subtype: user identity)?

Will FG unit give access to network resources to users, which was authenticate to AD before MPLS connector down?

I cannot afford LAN network break down when MPLS connector is down (too many local resources used even when MPLS is down).