FSSO over IPSEC VPN (mesh with Any to Any)

[skydivinggeek]

Hi All, 

I have a client with a mesh VPN that allows "any to any" in terms of network traffic. We also are running only Fortigate 100D/90D and a 90E all with FortiOS 5.4.4 spread over each site.

From each internal network, I can ping and talk to other networks without issue. 

All traffic between sites is allow and no policies disallow traffic flow internally. 

Now I have a windows domain controller (2012 R2) sitting at one site (10.1.0.10/32) with FSSO agent 5.0.0264 and DC agents to my other domain controllers (all 2012 R2) sitting at other sites. 

my other sites are: 10.2.0.0/16, 10.3.0.0/16 and 10.4.0.0/16

main site is: 10.1.0.0/16

So, my problem is that when I add the Single Sign on IP/password at a remote firewall (10.2.0.254/32 for example) to talk to my agent (10.1.0.10/32). it does not seem to connect to my central server and remains in a disconnected state. 

I am assuming that the firewall, cant or wont talk to the agent over the VPN? in fact, from the firewall, executing ping to agent IP results in packet loss. From inside networks, I can route traffic quite happily. 

I assume that because the firewall cant talk to the IP of the agent, this is the cause of my issue. But I would expect that because the rest of my networks can, then the firewall should be able too. 

We have a lot of local staff that roam from site to site, in fact they login at a site in the morning and then move to another site by lunch time. 

Previously, we used LDAP servers pointing to each site, but this would not catch all users. So I ended up having unauthenticated "catch all" policies that would still allow the user out if we could not determine the logon status of the user. 

And I want the firewall to filter internet traffic while relying on a central agent to share this user's group membership/logon status. So I can ultimately put working policies for outbound traffic without people slipping thru the cracks. 

Does anyone have a solution to this here or a work around? Any advice would be great. 

Regards,

Andy D.

[Marco]

Hi Andy

please try to set the source-ip field in your fsso config on the branch firewalls.

config user fsso

edit <fsso-entry-name>

set source-ip x.x.x.x

set the ip address to the internal FortiGate ip address which is routeable through the vpn tunnel.

Marco