FSSO with Multiple DC

[Silver]

Dear All, Can someone clear me in this scenario. i am using four domain controller on my network and installed fsso dc agent on the four domain controller. After that under authentication on fortigate i created four single sign on separately and all four connected but i only see groups appears on the first single sign on agent on the remain three no user group appears. can you confirm if its normal or abnormal. And out of four domain controller only the first two FSSO DC agent active 1 i see and the remain 2 saying active 0 does it normal or not. while checking on the fsso dc agent itself under monitor dc. users are connect to any four domain at the same time. example one user can connect to dc1 another user can connect to dc 4 randomly. waiting reply plz

[Silver]

Upload FSSO setting on fortigate

[veechee]

I believe the way you have it is fine. Listing multiple DCs on one FGT is for backup/failover purposes. The agents on all the DCs relay amongst one another all the login and IP information.

[Silver]

The Veechee thanks for the reply but it' s not really clear for me!!!

[Alivo__FTNT]

This design is imho unnecessary. What you can have is like 2 Collector Agents installed on two DC' s (for redundancy). Only one Collector Agent will be connected to FortiGate at any given time. If the connected Collector Agent fails for any reason, FortiGate will switch to another one down in the list. Just create one FSSO and in config enter two IP addresses. In standard mode then select groups for monitoring in Collector Agent. Then in Collector Agent specify DC' s that should be monitored for logon events. Both Collector Agent in fact will be monitoring logons yet only one will be sending info to FortiGate. I would suggest to use DC agent mode as it is considered most reliable.

[Fullmoon]

1. You may need to install the Collector Agent at the DC1 with step in the link Technical Tip : FSAE Standard mode installation procedure (Step by Step guide) http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD31882&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=29647444&stateId=0%200%2029645986 1.1)Then you just need to follow the path in the DC1 to get " nstalldcagent" from DC1 to install in DC2 ,DC3 ,DC4. (So only DC1 will have the Collector Agent with GUI. But for the other DC ,it may not have.) For 64 bits C:\Program Files (x86)\Fortinet\FSAE\installdcagent For 32 bits. C:\Program Files\Fortinet\FSSO\installdcagent (And it will has uninstalldcagent for you to use to uninstall only the DC agent also. ) and copy " installdcagent" from DC1 to install to DC 2 ,DC3 ,and DC4. When you install ,it will ask the information of the Collector Agent that you may need to put in Collector Agent IP address : (The AD server that has the Collector Agent (DC1) ,Collector agent with GUI and DC agent installed. ) Collector Agent listening port : (The default is 8002 )

[Alivo__FTNT]

Just a hint, I would personally not recommend to use Collector Agent (Set Directory Access information) Standard mode as it does not support nested AD groups > which is quite common scenario. In advance mode the easiest setup would be to select monitored AD groups from Collector Agent which will then send AD groups to be used as a set member attribute in group configuration to FortiGate. in FSSO configuration LDAP is then not required. when this change in Collector Agent is done you may want to run: execute fsso refresh in CLI

[Dipen]

can you use DC Agents without Collector Agents ? I don' t think so !! If you gave 4 Dcs please install DC agents on all 4 , but Collector agent required only on 2 for redundancy

[Dipen]

Firstly are all 4 domain controllers ADCs of each other ? In that case please install Collector agent only on two Domain Controllers. You can install DC Agent on all 4 domain controllers. Please login to Collector agent on both DCs and click " Show monitored DCs" It should show all 4 DCs on both Collector Agents. in Fortigate GUI create only one SSO Profile and add two Collector Agents under same SSO Profile. No need to create 4 SSO Profiles. more thoughts anyone ?