I configured SSO/Identity-Poll Active Directory Server on FGT81E (v6.0.2) against DC W2016 customer.
By yesterday, everything worked ok. Today I noticed an unusual traffic on the interface to DC (15Mbps in and 3Mbps out). The FGT CPU is loaded to about 30-50%, and according to the diagnosis the process that causes it is "smbcd" . I checked the entire network for a loop. Then I disable the SSO on FGTand it all stopped (traffic and CPU load).
When I review the FGT Local Log, I see that FGT sent SMB to DC - see the screenshot
Any idea please? Is it better to use native SSO queries or using FSSO collector installed on DC?
config user fsso-polling edit 1 set status enable set server "172.28.0.2" set default-domain '' set port 0 set user "*****" set password ENC G2uc5cCSGI9O4YfmFxE1Tlc93smM******H6J3bA6TqxsQukmYIDRhKeJocDeCOblAjyRLu8+XCTAGMYGoqXp+zAxAiCq0jNhs54szG9gI2XhkEu5qZe/mdxdFBaXCKlnZs/yTEiJOxZqsc4/s1wImzvmPA3g4s5B6mTGRvhI9bv2PXhaELCWgaJvF12WhE4vxQ== set ldap-server "SX-PDC" set logon-history 8 set polling-frequency 10 config adgrp edit "CN=Domain Admins,CN=Users,DC=***,DC=local" next edit "CN=****,CN=Users,DC=***,DC=local" next edit "CN=Domain Users,CN=Users,DC=***,DC=local" next end next end
config user fsso edit "Local FSSO Agent" set server "127.0.0.1" set port 8000 set password ENC T+pj6xGEiSGURtNFUrj+jgBzM66h2xYPJtgMNcywfP+YCzmqcEG1pKHf5nwPXPMO0qY2bmPveBbx3Qt/AmAeKxJTtxrjt9zgDXVbe5Wb9lJQZr9bYW0esEwZK2O3t/XbRsEmg1QjJkT7RqnfEC3ECfDWVNg1hcaQjOpz7Z7krcsZnhDM+5ujSjzc+H0K9L7NdY9how== set source-ip6 :: next end
config user ldap
edit "SX-PDC" set server "172.28.0.2" set secondary-server '' set tertiary-server '' set source-ip 0.0.0.0 set cnid "sAMAccountName" set dn "dc=****,dc=local" set type regular set username "****" set password ENC 9ewB6iD5d9FEylv+YK75OalgQlVLaeemOhcOG8sTTG8TB+N4b0+Jji6qy0CtXJ2sQcftRZrqb6GUGmFjak99K5wY88FLVyZPu/jN7s4HTXcUqub0cwhxoq0vjEdEvnxPk/wwY//mtLBKafLKqY9/1hsG+GLGBMJza4eNcmB+gBgejeK3J55JfBfABr6HIUh5z5K00Q== set group-member-check user-attr set group-search-base '' set group-filter '' set secure starttls set ssl-min-proto-version default set ca-cert '' set port 389 set password-expiry-warning disable set password-renewal disable set member-attr "memberOf" set account-key-processing same set account-key-filter "(&(userPrincipalName=%s)(!(UserAccountControl:1.2.840.113518.104.22.1683:=2)))" next end
I would call it normal, or expected. What FGT with configured FSSO polling do is to read WinSec log in a chunks and then parse that log to find out useful user logon records. That should be done via SMB RPC calls vith help of fssod smbcd and authd .. all those daemons participate in this. So the FSSO collector on FGT (that't what local polling is) cost you a bit of CPU. On low end models it seems to me a bit costly. If I consider that same job and to be honest better job can be done by standalone Collector installed right on DC with plenty of multi-core hyper-threaded CPU raw power.
So to your last question, my answer is 'it's always better to run dedicated standalone collector agent then local polling'.
I thing there was Fortinet KB article about differences but in short what FGT poller does not and standalone Collector Agent (CA) does:
- FGT poller does only WinSec - CA can do 3 types of polling + listen to 2 types of agents + RSSO + Syslog to SSO + Exchange server monitor ...
- FGT without ability to choose which events to poll - in CA you can choose from 3 presets and/or manually specify explicitly for example EventIDs like 4624 only
- resources .. spoke about above
- FGT does not do workstation checks, cache LDAP, have alt.DNS - CA does have all that
So for start-up So-Ho, one DC domain + few <10 users .. or POC lab test, the FGT poller is enough, for anything bigger I'd recommend to use standalone Collector Agent. Which is free of charge part (download from support.fortinet.com from under FortiOS) and resources consumption on DC is supposed to be insignificant.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.