FortiClient receiving wrong profile

[TomS]

I' m running 5.2 on a 90D, and seem to be having trouble getting the right profile applied to the FortiClients. I have multiple profiles, assigned to machines by group. Looking in the FortiClient monitor, I can see machines which are in a group that should be assigned to a profile which are using the default profile. I can' t see any way to debug these though, either in the CLI or the web interface The only thing I can see that' s different is some are registered - On-Net, and some are Off-Net (though they' re all online, so I' m not sure what the difference is). Anyone got any advice. Thanks Tom.

[TomS]

Known bug apparently. So that' s OK then...

[nicoco59]

Hi TomS,

I have the same issue here. I'm using FSSO and FSSO is working perfectly. But I would like to assign different profile to different groups and I have an issue... All users are still using the default profile.. They are never switched to the correct profile..

Did you find any info in order to debug ? 

     Record #38:
              IP_Address = 172.16.40.130(38)
              VDOM = root
              Registration status: Forticlient registered
              Online status: offline
              FCC connection handle: 3982
              FortiClient version: 5.0.10
              AVDB version: 26.199
              FortiClient app signature version: 6.656
              FortiClient vulnerability scan engine version: 1.380
              FortiClient feature version status: 0
              FortiClient config dirty: 0:1:1
              FortiClient KA interval dirty: 0
              FortiClient Full KA interval dirty: 0
              FortiClient server config: 2229b7b211a25d890de979fb8eb5c150::
              FortiClient config: 2229b7b211a25d890de979fb8eb5c150
              FortiClient iOS server mconf:
              FortiClient iOS mconf:
              FortiClient iOS server ipsec_vpn mconf:
              FortiClient iOS ipsec_vpn mconf:
              Endpoint Profile: default
              Reg record pos: 37
              Auth_AD_groups: Utilisa. du domaine+Proxy-Utilisateur+CERTSVC_DCOM_ACCESS+Utilisateurs
              Auth_group:
              Auth_user:
              OS_Version: Microsoft Windows 7 , 64-bit Service Pack 1 (build 7601)
              Host_Description: ThinkCentre M93 - Win7 x64 - Toto
              Domain: xxxx
              Last_Login_User: Toto
              Host_Model:
              Host_Manufacturer: LENOVO
              CPU_Model: Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz
              Memory_Size: 4096
              Installed features: 55
              Enabled features: 17

But the user Toto should be on the group "Proxy" :

    edit "FSSO-PROXY-VPNIPSEC"
        set group-type fsso-service
        set member "CN=Proxy-VPNIPSEC,CN=Builtin,DC=domain,DC=fr"
    next

FW1 # diagnose test authserver ldap LDAP-DOMAIN Toto password
authenticate 'Toto' against 'LDAP-DOMAIN' succeeded!
Group membership(s) - CN=Proxy-VPNIPSEC,CN=Builtin,DC=domain,DC=fr
                      CN=Proxy-Utilisateur,CN=Builtin,DC=domain,DC=fr
                      CN=Utilisa. du domaine,CN=Users,DC=domain,DC=fr

Thanks and Best Regards,

Nick

[TomS]

I was told the issue was fixed in the 5.2 release a few months after I posted.

It's not, as far as I can see.

I have mostly worked around it by adding a profile for machines and a profile for users that do the same job (users mostly stick to a single machine here). One or other of the profiles normally picks them up, the default is right for about 75% of users anyway. Occasionally a machine will drop right out the bottom and end up with no config at all, but a refresh normally sorts that out. I had to figure this out myself, they don't suggest anything useful if you contact support.

I've given up on Fortigate support for anything that's not mission critical. Even then the support is very slow and don't really do anything except tell you to wait for the next release, which may or may not fix it. And they can't tell you when it will be. Oh, and they'll give you a bug number you can't look up. and which won't appear in the release notes.