Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Silver
New Contributor

FSSO with Multiple DC

Dear All, Can someone clear me in this scenario. i am using four domain controller on my network and installed fsso dc agent on the four domain controller. After that under authentication on fortigate i created four single sign on separately and all four connected but i only see groups appears on the first single sign on agent on the remain three no user group appears. can you confirm if its normal or abnormal. And out of four domain controller only the first two FSSO DC agent active 1 i see and the remain 2 saying active 0 does it normal or not. while checking on the fsso dc agent itself under monitor dc. users are connect to any four domain at the same time. example one user can connect to dc1 another user can connect to dc 4 randomly. waiting reply plz
8 REPLIES 8
Silver
New Contributor

Upload FSSO setting on fortigate
veechee
New Contributor

I believe the way you have it is fine. Listing multiple DCs on one FGT is for backup/failover purposes. The agents on all the DCs relay amongst one another all the login and IP information.
Silver
New Contributor

The Veechee thanks for the reply but it' s not really clear for me!!!
Alivo__FTNT
Staff
Staff

This design is imho unnecessary. What you can have is like 2 Collector Agents installed on two DC' s (for redundancy). Only one Collector Agent will be connected to FortiGate at any given time. If the connected Collector Agent fails for any reason, FortiGate will switch to another one down in the list. Just create one FSSO and in config enter two IP addresses. In standard mode then select groups for monitoring in Collector Agent. Then in Collector Agent specify DC' s that should be monitored for logon events. Both Collector Agent in fact will be monitoring logons yet only one will be sending info to FortiGate. I would suggest to use DC agent mode as it is considered most reliable.

livo

Fullmoon
Contributor III

1. You may need to install the Collector Agent at the DC1 with step in the link Technical Tip : FSAE Standard mode installation procedure (Step by Step guide) http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD31882&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=29647444&stateId=0%200%2029645986 1.1)Then you just need to follow the path in the DC1 to get " nstalldcagent" from DC1 to install in DC2 ,DC3 ,DC4. (So only DC1 will have the Collector Agent with GUI. But for the other DC ,it may not have.) For 64 bits C:\Program Files (x86)\Fortinet\FSAE\installdcagent For 32 bits. C:\Program Files\Fortinet\FSSO\installdcagent (And it will has uninstalldcagent for you to use to uninstall only the DC agent also. ) and copy " installdcagent" from DC1 to install to DC 2 ,DC3 ,and DC4. When you install ,it will ask the information of the Collector Agent that you may need to put in Collector Agent IP address : (The AD server that has the Collector Agent (DC1) ,Collector agent with GUI and DC agent installed. ) Collector Agent listening port : (The default is 8002 )

Fortigate Newbie

Fortigate Newbie
Alivo__FTNT
Staff
Staff

Just a hint, I would personally not recommend to use Collector Agent (Set Directory Access information) Standard mode as it does not support nested AD groups > which is quite common scenario. In advance mode the easiest setup would be to select monitored AD groups from Collector Agent which will then send AD groups to be used as a set member attribute in group configuration to FortiGate. in FSSO configuration LDAP is then not required. when this change in Collector Agent is done you may want to run: execute fsso refresh in CLI

livo

Dipen
New Contributor III

can you use DC Agents without Collector Agents ? I don' t think so !! If you gave 4 Dcs please install DC agents on all 4 , but Collector agent required only on 2 for redundancy

Ahead of the Threat. FCNSA v5 / FCNSP v5

Fortigate 1000C / 1000D / 1500D

 

Ahead of the Threat. FCNSA v5 / FCNSP v5 Fortigate 1000C / 1000D / 1500D
Dipen
New Contributor III

Firstly are all 4 domain controllers ADCs of each other ? In that case please install Collector agent only on two Domain Controllers. You can install DC Agent on all 4 domain controllers. Please login to Collector agent on both DCs and click " Show monitored DCs" It should show all 4 DCs on both Collector Agents. in Fortigate GUI create only one SSO Profile and add two Collector Agents under same SSO Profile. No need to create 4 SSO Profiles. more thoughts anyone ?

Ahead of the Threat. FCNSA v5 / FCNSP v5

Fortigate 1000C / 1000D / 1500D

 

Ahead of the Threat. FCNSA v5 / FCNSP v5 Fortigate 1000C / 1000D / 1500D
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors