Gaps in user column in logs - users not matching policies

[thomasd1]

For about 4 weeks now i have started to see some gaps in the Logs for forward traffic.

some logs with the gaps are matched to IP's of user machines, but they are getting deny all as it cannot validate a policy against a user.

FSSO is setup and looks to be working correctly, the only thing that has changed was a change of certificate that we were using for SSL Inspection as we reconfigured our NPS server.

I am at a bit of a loss at what else to look at.

[Stephen_G]

Hello thomasd1,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[rp1996 · Accepted solution]

Hi Thomas, 

Could  you please clarify that if you can co-relate the gaps that you are referring to deny traffic in the forward logs, you can verify this by filter the log with the source IP. 

Once you have confirmed that the traffic is being denied, you would then need to check if there is a FSSO user entry for that particular IP, by running the following command on the CLI. 

diagnose debug authd fsso list  | grep 192.x.x.x   

The IP can also be replaced with the username. 

With the above you can check if the user entry was forwarded to the FortiGate or not, if there isnt any entry when there was supposed to be, you then need to check the FSSO collector agent and check for user information. 

If you find the user information but not on the FortiGate then we must check to see if there is any communication issue between the FortiGate and the collector agent. 

If no entry in the collector agent, then this could be a polling issue where in the logon event is missed by the collector agent or the DC agent depending on what your setup is.