Fortinet Logging - AD user not updating

[kvt]

Hello,

I've setup a rule where users in specific AD group can browse internet. When User 1 logs in to Computer 1 its working fine and I'm seeing the user traffic in the logs (user1@domain.local). But if User 2 logs in to the same computer (Computer 1) and start browsing the internet in the logs i see user1@domain.local not user2@...

Does anyone have an idea why's that?

Thanks!

[Debbie_FTNT]

Hey kvt,

FortiGate might have simply still cached the login of user1, depending on your setup.

How does FortiGate know when user1 or user2 is logged in?

How does it detect logouts?

Is this an explicit proxy setup?

What firmware version is the FortiGate?
Some background on your setup would be helpful to have an idea as to what could be happening.

[kvt]

Hello,

We have FortiNET 7.04. Since I'm new to Forti it can happen we are missing some setting?

I created Fortinet Single Sign-On (FSSO) connector to our AD server, so the users can have access to the internet based on their AD rights.

I hope it helps a bit.

THanks

[Debbie_FTNT]

Did you create an AD connector (FortiGate is polling login activity), or did you create a connector to an FSSO agent?

If a connector to an FSSO Agent, check on the FSSO Agent if a change in user is detected in a timely manner; you should have a logged on user list that should show currently logged in users, and Collector Agent will share this information with the FortiGate.

If you have an AD connector (FortiGate doing the polling itself) it sounds a bit as if FortiGate is not detecting the change in user immediately. This can happen with FortiGate polling, as it only checks a very limited set of event IDs in Windows Security Event log, and those can't be changed.

In that case, you might want to switch to a Collector Agent to have more precise polling, so the user change is detected and reflected on the FortiGate speedily.

[kvt]

I'll give it try. Thanks for the help!