Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
FrancoisBlanchon
New Contributor

FSSO questions : filter unwanted logon entries related to client private IPs

Hi all,

 

I setup user auth with FSSO DC agent mode, and as there is many entries I would like to filter a bit.

The filter criteria I would like to setup is based on the workload IP addresses.

I have many users, connecting from home, that have FSSO entries with their own private home IPs.

For example. user lamdba is seen with its VPN tunnel IP to Office and its private IP (so 2 FSSO entries).

As the last ones are useless for filtering, I would like to know if it is possible to filter on DC agent or Collector Agent ?

Thanks a lot

FB

1 Solution
mturic
Staff
Staff

Hi,

 

there is a registry entry in FSSO Collector Agent that you could use, dc_agent_ignore_ip_list. All IP addresses added to this registry entry will be ignored for IP based FSSO.
In this registry entry you can add individual IPs, and starting from FSSO CA version 5.0.0302,  IP address ranges in the following format: 1.2.3.4;10.0.0.0-20.255.255.255;7.8.9.0

 

Also worth mentioning, this works for DC Agent mode and Polling mode as well, only TS-Agent logons will not be affected by this registry entry.

You can check the following article for further info:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Excluding-IP-addresses-from-FSSO-logon-eve...

View solution in original post

2 REPLIES 2
mturic
Staff
Staff

Hi,

 

there is a registry entry in FSSO Collector Agent that you could use, dc_agent_ignore_ip_list. All IP addresses added to this registry entry will be ignored for IP based FSSO.
In this registry entry you can add individual IPs, and starting from FSSO CA version 5.0.0302,  IP address ranges in the following format: 1.2.3.4;10.0.0.0-20.255.255.255;7.8.9.0

 

Also worth mentioning, this works for DC Agent mode and Polling mode as well, only TS-Agent logons will not be affected by this registry entry.

You can check the following article for further info:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Excluding-IP-addresses-from-FSSO-logon-eve...

FrancoisBlanchon

Hi mturic,

Thanks for information, it works.

Best regards,

François

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors