FortiManager and FSSO agents

[Roysmith]

Hi

Looking for some advice, if anyone can help. We have a few remote sites each with a Fortigate HA cluster with ADVPN connetivity between the sites. We have a Fortimanager at our primary site which as also managing some of the remote sites but not all of them. We also have a FSSO server at the primary site and 2 of the remote sites. So, I went through the process of adding the Fortigate at one of these remote sites to FortiManager. for the most part it went ok but we have had issues with the FSSO agents.

The import process imported ther SSO agent settings from the remote site. What we discovered was that this had a couple of duplicate entries, that were also on the primary FSSO agent. I am referring the configuration in FortiManager at Object Configurations > Fabric Connectors > Endpoint/Identity.

What we found is that the 2 FSSO agents cannot have the same groups or users in them. If you add a duplicate entry it disappears from the other agent. Also, when pushing policy, the installation wizard attempted to create or edit the new FSSO agent. However, as the source-ip is using a local IP on the Fortigate, the remote one would fail, as that source-ip does not exist on the local Fortigate.

Has anyone had any similar issues?

This also begs the question - Can you have multiple FSSO agents configrued in FortiManager, even when they across multiple sites and behind remote gateways?

Hope that makes sense to someone and if anyone can shed some light on this, that would be greatly appreciated.

Many Thanks
Roy

[Anthony_E]

Hello Roy,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Roysmith]

Hi Katenshw

I may be getting mixed up with the Fortinet terminology here so excuse me if I complicates things. 

I have no issues with have 1 FSSO object pointing to 2 or more collector servers. In fact I can see the advantage in that. The fact that you can have up to 5 collectors specified should provide the required resiliency.

However, my issue with just having 1 FSSO object in FortiManager is the source-ip of that object. This source-ip only exists on 1 of the gateways, so when a policy install is done on another gateway, the policy fails due the source-ip not existing. If I remove the source-ip entry, it appears to replace it with 0.0.0.0. Anyway, if I do this, user authentication fails on the gateway. Why do I need to specify a source-ip? Is there a way to get around it? How do I get to install that object on multiple gateways?

Thanks

Roy

[Jorg_SVC]

Hi @Roysmith 

I have the same issue on FMG 7.4.4. Did you manage to fix this?

Thanks,

Jorg

[Debbie_FTNT]

Hey @Jorg_SVC , @Roysmith 

You should be able to set specific source IPs if you enable per-device mapping in the FSSO connector.

Then you can set source IPs on each mapped object, not just in the general FSSO connector, and push that out to each FortiGate.

You do not NEED to set a source IP by default (simply leave the source IP entry empty then), but if the Collector Agent/Authenticator the connector points to is reachable via a site-to-site tunnel, then source-ip might be required to ensure the traffic is sent out correctly.

Cheers,

Debbie

[Jorg_SVC]

Hi @Debbie_FTNT 

My issue is with the LDAP groups I use in multiple connectors at the same time.

The same as Roy mentioned:

What we found is that the 2 FSSO agents cannot have the same groups or users in them. If you add a duplicate entry it disappears from the other agent.

Regards,

Jorg

[Debbie_FTNT]

Hey Jorg_SVC,

thanks for the clarification. I was under the impression that yours (and Roy's) issue was this:

"[...] I have no issues with have 1 FSSO object pointing to 2 or more collector servers. In fact I can see the advantage in that. [...] my issue with just having 1 FSSO object in FortiManager is the source-ip of that object. This source-ip only exists on 1 of the gateways, so when a policy install is done on another gateway, the policy fails due the source-ip not existing. [...]"

To hopefully answer your question:
- yes, a particular group can only be associated with a single FSSO connector

- you CAN put multiple servers into the same FSSO connector, and those servers do not need to communicate with each other

- I'm not entirely sure why you would want or need more than one FSSO connector for the same domain?

[Jorg_SVC]

Hi @Debbie_FTNT 

We 8 factories. Each location needs to be independent as possible. The AD Domain is obviously the same but at each factory we have local domain controllers and a local FSSO Collector Agent installed, so that's why we need multiple FSSO connectors.

In my opinion this a shortcoming in FortiManager. It doens't make sense why FMG can't handle this configuration.

Regards,

Jorg

[Debbie_FTNT]

Hey Jorg,

ok, in the case you describe - 8 locations, that each have the same domain, you CAN in fact use a singe connector in FortiManager.

You simply have to enable per-device-mapping on the connector to create customized versions of the same connector for each FortiGate.

The connector will have the same name, essentially, and use the same groups, but it should have independent IPs for each location.

Cheers,

Debbie