Hi,
After applied Windows cumulative update KB5004948 in my environment, the Poll Active Directory is appearing the following error:
# diagnose debug fsso-polling detail 1 AD Server Status(err: server can not be accessible):
The Fortigate is running with FortiOS 6.2.9.
I have opened a ticket with Fortinet support, but I didn't receive yet a reply about the solution to fix this issue.
Someone is with this same issue or has a solution to solve it?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
I have upgraded from 6.4.6 to 6.4.7 and the local fsso connectors are up now. But the fortigate still cannot read the event logs and the I don't see any authenticated users on the fortigate.
I see this error:
smbcd: rpc_cmd_eventlog_read:944 init=0, eof=1, timestamp=1634545128, Mon Oct 18 08:18:48 2021 status=0 smbcd: smbcd_process_request:981 got cmd id: 6 smbcd: smbcd_process_request:994 got rpc log field. smbcd: smbcd_process_request:1006 got rpc username: Fortigate smbcd: smbcd_process_request:1012 got rpc password: XXXXXXXX smbcd: smbcd_process_request:1016 got rpc port: 0 smbcd: smbcd_process_request:1022 got rpc logsrc: security smbcd: smbcd_process_request:1000 got rpc server: 10.1.1.1 smbcd: smbcd_process_request:1049 got VFID, 0 smbcd: smbcd_process_request:1182 got rpc eventlog read command smbcd: rpccli_eventlog_open:203 /code/FortiOS/fortinet/daemon/smbcd/smbcd_eventlog.c-203: evenglog handle get failed.nt_status:-1073741790. Retry to open pipe with auth. smbcd: eventlog_read:574 id= 4769, r.TimeGenerated=1634545128, Mon Oct 18 08:18:48 2021 , curren time=1634545119, Mon Oct 18 08:18:48 2021 , time_after=1. smbcd: eventlog_read:574 id= 4769, r.TimeGenerated=1634545128, Mon Oct 18 08:18:48 2021 , curren time=1634545119, Mon Oct 18 08:18:48 2021 , time_after=1. smbcd: eventlog_read:622 loop=4, timestamp=1634545129, Mon Oct 18 08:18:49 2021
Does anyone has an idea? Support ticket is open yet. Thanks and kind regards, Judit
That looks like FortiGate with patched FSSO poller, trying to poll your DCs which are not patched.
Microsoft one-sidedly changed how external apps can access WinSec and broke the FSSO polling on FGT and FAC.
As they did so to fix security vulnerabilities we do assume those fixes will be applied sooner or later to every Windows DC. And so newer FortiOS does count with that. Unfortunately the access cannot be made working for both patched and unpatched as well. Either one is the only option. And that's why FortiOS versions 6.2.10 , 6.4.7 , 7.0.2 do have patched FSSO poller version.
Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff
Do we have any update on the rsolution of this issue?? We are facing it and need help to resolve.
Thanks in advance
SwapnilR
Hey Swapni,
as mentioned multiple times in the thread above - Microsoft updated how the event logs may be accessed, in the process breaking polling mode.
FortiOS 6.2.10, 6.4.7 and 7.0.2 contain fixes to the local FortiGate poller to take into account the Microsoft patches.
However, the changes in FortiGate are NOT backward compatible - if you have a FortiGate operating on those versions (or higher), your DCs need to be patched sufficiently to include the mention changes to Security Event logging.
If some of your DCs are patched, and some are not, then depending on the FortiGate firmware version it can either poll the patched or the unpatched ones, but not both.
I would suggest that you ensure your FortiGate is at one of the mentioned versions at least, and your domain controllers have all available updates applied.
If you are looking for additional information or assistance on the FortiGate side of things, please open a Technical Support case.
Cheers!
I"ve this problem now... i'm investigating it.
now updating all windows dc's.
did you fix it ?
Created on 02-23-2022 12:26 AM Edited on 02-23-2022 12:27 AM
Hi Phillippe,
Yes FORTINET did fix what Microsoft updates messed up.
Kindly investigate how do you poll DCs (from FGT, through standalone Collector Agent, through Collector on FortiAuthenticator).
Then read this thread for all the details which being said here before.
And apply solution based on your polling method.
In short:
if you have latest Microsoft patches on DCs,
then you need latest versions of poller/FOS using those DCs.
Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff
KB5009472
KB4535680
KB4577586
KB4580325
KB4589208
KB5000859
KB5003711
KB5010427
KB5009642
thos KB are installed fw upgrade to 6.2.10
no result :(
the polling connector keeps down :
AD Server Status(err: server can not be accessible):
Hey Philippe,
that's not the ususal error we see if the issue is with the Windows patches/FortiGate version not matching. That error looks a bit more like a network issue or something blocking access from FortiGate completely.
I'm not sure how familiar you are with an AD environment and what goes on communication wise. If you feel confident to interpret what you might see, you can gather this debug:
- packet capture between FortiGate and the domain controller it is trying to poll (look for nca_s_access_denied, for example)
- this debug on the FortiGate:
#dia de reset
#dia de app smbcd -1
#dia de en
-> wait a few minutes
#dia de dis
#dia de reset
And then go from there.
If you're a bit uncertain what you might need to look for, I would suggest a ticket with Technical Support for more dedicated assistance in your troubleshooting.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1678 | |
1085 | |
752 | |
446 | |
226 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.