No Internet access when switching IP's

[eascolaro]

Hi,

We currently have a Single Sign-On Agent installed on 1 DC, which is configured to monitor all DC's.

All works fine until a users switches from wired Ethernet to Wifi, they are no longer able to browse the internet. To solve this, they would need to lock the laptop and log-in again to windows.  In the "Show Logon Users" the user will be listed with "wired" IP address and not Wifi IP.

I have tried reducing the "Workstation verify interval" to 1 minutes and the "IP address change verify interval" to 10 seconds but this did not solve the problem. 

Firmware: v5.2.7,build718 on 300D

[Fishbone_FTNT · Accepted solution]

Hi eascolaro,

it heavily depends on DNS. Wifi adapter has to be able to send DNS update to DNS server you are using. 

The feature used in this case is "IP change detection". It walks in the loop the logon list, and tries to resolve workstation name there. So if you move to Wifi, you must ensure DNS update reaches DNS server, it's reflected and DNS database is updated. Then, IP change detection feature will resolve workstation name correctly, containing fresh IP address and logon list is updated.

Fishbone )(

[eascolaro]

Fishbone wrote:

Hi eascolaro,

it heavily depends on DNS. Wifi adapter has to be able to send DNS update to DNS server you are using. 

The feature used in this case is "IP change detection". It walks in the loop the logon list, and tries to resolve workstation name there. So if you move to Wifi, you must ensure DNS update reaches DNS server, it's reflected and DNS database is updated. Then, IP change detection feature will resolve workstation name correctly, containing fresh IP address and logon list is updated.

Fishbone )(

Thank you for your feedback Fishbone. 

I doubt it is DNS related issues because on the internal DNS, both IP's are listed under the same host name. The fact that the user can access other authenticated related services, such as File server, means that the user is authenticated with the AD. Or am I missing something ? The IP change detection is not occurring unless the user locks his laptop (using Window key + L) and logs in again. 

[eascolaro]

I just checked the Event Viewer, and found an event log (ID 4624) with Wifi IP of when the user switched from Ehternet to Wifi.

An account was successfully logged on.

Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0

Logon Type: 3

Impersonation Level: Impersonation

New Logon: Security ID: Domain\USER$ Account Name: USER$ Account Domain: Domain Logon ID: 0x159B748D Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information: Process ID: 0x0 Process Name: -

Network Information: Workstation Name: Hostname Source Network Address: 192.168.X.X Source Port: 50941

Detailed Authentication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V2 Key Length: 128

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

[Agent_1994]

The IP change detection relies on DNS.

Lets say you're wired at WORKSTATION01.domain.local using 192.168.0.2 and then you switch to the wireless IP 192.168.1.2. The DNS record must be updated in order to detect the change. 

Take a look at your DNS configuration, specially dynamic updates.

[xsilver_FTNT]

Hi eascolaro,

mentioned ID 4624 caught my attention. Collector by default did not poll that event ID in some versions, so it might happen that logon event is left unattended. I'd suggest to check following KB and use latest collector:

http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD36424

Best regards,

Tomas

[eascolaro]

Hi again,

I did further testing and was finally able to replicate the problem on test user account and laptop.  The DNS is working as it should. The host name in the DNS zone is being updated with new IP, and when I switch Ethernet, it gets updated. I also tried putting a static IP and it immediately updated to the static IP. Test procedure: 

Step 1) Connected to fixed IP on Ethernet : Internet working Step 2) Connected to Wi-Fi (DHCP) : Internet working Step 3) Removed fixed IP and re-connected to Ethernet (DHCP): Internet Stopped working

I have checked the following:

DNS is set to the correct Ethernet DHCP IP of step 3. Event ID: 4624 showing to account name and correct Ethernet DHCP IP of step 3.

In FSSO, in the "Show Logon Users", I find the user account with IP of step 1 and step 2. But NOT of step 3. The last event I find on the FSSO log shows the wrong IP. Please note that this log happened at 12:31

01/09/2017 12:31:21 [LOGON_ITEM] logon:1 ip:192.168.169.137 workstation:192.168.169.137 domain:ZACHARY user:teuser

  The event log with correct IP was recorded at 12:18 (well before the FSSO log)

[eascolaro]

This is the Logon user list showing the wrong IP's

 

[eascolaro]

Forgot to add that I also updated to the latest FSSO agent which is Ver 5.0.0251

[pyy]

Hello,

In your case i would suggest 2 steps

a. On the Firewall policy/policies that you are having the FSSO group enable the ntlm config firewall policy

edit XX

set ntlm enable

next

end

b. On the user PC open Internet explorer

tools -> Internet Options -> Security tab -> Custom Level (for internet) and at the bottom you will find user authentication

Choose Automatic logon with current username and password.

Best regards

Panos