FSSO with two Domain Controllers not working

[joebrug1]

Two domain controllers set up for redundancy via Forti support. Both have the collector agent installed, and both are pointed to the DC agents on each. 

Since the fortigate 200F can only connect to one collector agent at a time.. only the users who are authenticated to that logon server (e.g. DC1) are getting the firewall rules applied. We're using FSSO for web filtering, mainly. Users can either get authenticated to DC1 or DC2. I swear this was working at some point. we're also using the TS Agent on our 5 RDS hosts, if that matters. 

What am I missing configuration wise to make the fortigate work with users regardless of which DC they happened to be authenticated with?

[hbac]

Hi @joebrug1,

On the DC agent, there is an option to configure monitored DC: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-FSSO-in-DC-Agent-mode/ta-p/25299...

Regards, 

[joebrug1]

Correct. So heres the weird thing. If I'm in Collector Agent on DC1, and hit "Monitored DC's" i see Dc1, DC2, and my 5 TS Agents.. so 7 active DC Agents. If I view it on DC2, I only see the 5 TS Agents. However, if I click "Select DC to Monitor" and choose DC1 and DC2, then nothing happens and it still only shows "Active DC Agents: 5" (the TS agents). If i Uncheck them, or only check1, it asks if I want to remove the DC Agent from the other.