Problem to track individual users on a FSSO environement

[serveiwebs]

Hi everyone,

I have a FortiGate 60F with Fortios 6.4 for to protect my Windows with Active Directory network.
I have setup the FSSO Agent into my server, and is linked to my FortiGate. I can obtain usergroups list from my AD and the device shows 'up' in the External Connector section into admin web.

Here I my case: I use wifi router for to provide access to several users, this was my previous device to provide internet before current FortiGate. And when I check users activity, all the sessions and web visits and almost all the log registries of any activity are not user-related, but IP related. 
This IP is always the router one, because users are 'behind' the router and share this IP. Is there a way that my FortiGate 'recognizes' the individual user that is performing the actions and stores it?

In essence, maybe having all my users sharing same internal IP makes FortiGate unable to individualize then, even if I have the FSSO Agent working with my Active Directory?

Thanks a lot and kind regards.

[ebilcari · Accepted solution]

From your description it looks like the router is doing NAT to the user's traffic. Is there a limitation that you can't do plain routing in this setup?

Basically what FSSO does is matching a user to the IP and use the IP on policy matching for incoming traffic. If the traffic is sourced by the same IP there is no way to differentiate it. If you can configure plain routing without NAT it should work with your current configurations.

There is a solution using TS agent that can identify users by ports but it can't be used in this setup.

[serveiwebs]

Thanks a lot, very clear explanation.