Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi TomS,
I have the same issue here. I'm using FSSO and FSSO is working perfectly. But I would like to assign different profile to different groups and I have an issue... All users are still using the default profile.. They are never switched to the correct profile..
Did you find any info in order to debug ?
Record #38:
IP_Address = 172.16.40.130(38)
VDOM = root
Registration status: Forticlient registered
Online status: offline
FCC connection handle: 3982
FortiClient version: 5.0.10
AVDB version: 26.199
FortiClient app signature version: 6.656
FortiClient vulnerability scan engine version: 1.380
FortiClient feature version status: 0
FortiClient config dirty: 0:1:1
FortiClient KA interval dirty: 0
FortiClient Full KA interval dirty: 0
FortiClient server config: 2229b7b211a25d890de979fb8eb5c150::
FortiClient config: 2229b7b211a25d890de979fb8eb5c150
FortiClient iOS server mconf:
FortiClient iOS mconf:
FortiClient iOS server ipsec_vpn mconf:
FortiClient iOS ipsec_vpn mconf:
Endpoint Profile: default
Reg record pos: 37
Auth_AD_groups: Utilisa. du domaine+Proxy-Utilisateur+CERTSVC_DCOM_ACCESS+Utilisateurs
Auth_group:
Auth_user:
OS_Version: Microsoft Windows 7 , 64-bit Service Pack 1 (build 7601)
Host_Description: ThinkCentre M93 - Win7 x64 - Toto
Domain: xxxx
Last_Login_User: Toto
Host_Model:
Host_Manufacturer: LENOVO
CPU_Model: Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz
Memory_Size: 4096
Installed features: 55
Enabled features: 17
But the user Toto should be on the group "Proxy" :
edit "FSSO-PROXY-VPNIPSEC"
set group-type fsso-service
set member "CN=Proxy-VPNIPSEC,CN=Builtin,DC=domain,DC=fr"
next
FW1 # diagnose test authserver ldap LDAP-DOMAIN Toto password
authenticate 'Toto' against 'LDAP-DOMAIN' succeeded!
Group membership(s) - CN=Proxy-VPNIPSEC,CN=Builtin,DC=domain,DC=fr
CN=Proxy-Utilisateur,CN=Builtin,DC=domain,DC=fr
CN=Utilisa. du domaine,CN=Users,DC=domain,DC=fr
Thanks and Best Regards,
Nick
I was told the issue was fixed in the 5.2 release a few months after I posted.
It's not, as far as I can see.
I have mostly worked around it by adding a profile for machines and a profile for users that do the same job (users mostly stick to a single machine here). One or other of the profiles normally picks them up, the default is right for about 75% of users anyway. Occasionally a machine will drop right out the bottom and end up with no config at all, but a refresh normally sorts that out. I had to figure this out myself, they don't suggest anything useful if you contact support.
I've given up on Fortigate support for anything that's not mission critical. Even then the support is very slow and don't really do anything except tell you to wait for the next release, which may or may not fix it. And they can't tell you when it will be. Oh, and they'll give you a bug number you can't look up. and which won't appear in the release notes.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1633 | |
1063 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.