Hello,
I configured SSO/Identity-Poll Active Directory Server on FGT81E (v6.0.2) against DC W2016 customer. By yesterday, everything worked ok. Today I noticed an unusual traffic on the interface to DC (15Mbps in and 3Mbps out). The FGT CPU is loaded to about 30-50%, and according to the diagnosis the process that causes it is "smbcd" . I checked the entire network for a loop. Then I disable the SSO on FGTand it all stopped (traffic and CPU load).
When I review the FGT Local Log, I see that FGT sent SMB to DC - see the screenshot
Any idea please? Is it better to use native SSO queries or using FSSO collector installed on DC?
SSO cfg:
config user fsso-polling
edit 1
set status enable
set server "172.28.0.2"
set default-domain ''
set port 0
set user "*****"
set password ENC G2uc5cCSGI9O4YfmFxE1Tlc93smM******H6J3bA6TqxsQukmYIDRhKeJocDeCOblAjyRLu8+XCTAGMYGoqXp+zAxAiCq0jNhs54szG9gI2XhkEu5qZe/mdxdFBaXCKlnZs/yTEiJOxZqsc4/s1wImzvmPA3g4s5B6mTGRvhI9bv2PXhaELCWgaJvF12WhE4vxQ==
set ldap-server "SX-PDC"
set logon-history 8
set polling-frequency 10
config adgrp
edit "CN=Domain Admins,CN=Users,DC=***,DC=local"
next
edit "CN=****,CN=Users,DC=***,DC=local"
next
edit "CN=Domain Users,CN=Users,DC=***,DC=local"
next
end
next
end
config user fsso
edit "Local FSSO Agent"
set server "127.0.0.1"
set port 8000
set password ENC T+pj6xGEiSGURtNFUrj+jgBzM66h2xYPJtgMNcywfP+YCzmqcEG1pKHf5nwPXPMO0qY2bmPveBbx3Qt/AmAeKxJTtxrjt9zgDXVbe5Wb9lJQZr9bYW0esEwZK2O3t/XbRsEmg1QjJkT7RqnfEC3ECfDWVNg1hcaQjOpz7Z7krcsZnhDM+5ujSjzc+H0K9L7NdY9how==
set source-ip6 ::
next
end
config user ldap
edit "SX-PDC"
set server "172.28.0.2"
set secondary-server ''
set tertiary-server ''
set source-ip 0.0.0.0
set cnid "sAMAccountName"
set dn "dc=****,dc=local"
set type regular
set username "****"
set password ENC 9ewB6iD5d9FEylv+YK75OalgQlVLaeemOhcOG8sTTG8TB+N4b0+Jji6qy0CtXJ2sQcftRZrqb6GUGmFjak99K5wY88FLVyZPu/jN7s4HTXcUqub0cwhxoq0vjEdEvnxPk/wwY//mtLBKafLKqY9/1hsG+GLGBMJza4eNcmB+gBgejeK3J55JfBfABr6HIUh5z5K00Q==
set group-member-check user-attr
set group-search-base ''
set group-filter ''
set secure starttls
set ssl-min-proto-version default
set ca-cert ''
set port 389
set password-expiry-warning disable
set password-renewal disable
set member-attr "memberOf"
set account-key-processing same
set account-key-filter "(&(userPrincipalName=%s)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))"
next
end
PID RSS ^CPU% MEM% FDS TIME+ NAME
* 298 7M 49.2 0.4 8 00:02.22 smbcd [x2]
139 18M 21.3 1.0 11 00:03.65 httpclid [x3]
127 32M 4.7 1.7 25 01:48.83 httpsd [x6]
125 34M 0.8 1.8 60 00:35.35 miglogd [x3]
131 4M 0.0 0.2 11 00:03.59 merged_daemons
132 7M 0.0 0.4 13 00:00.25 fnbamd
133 4M 0.0 0.2 12 00:00.80 fclicense
134 14M 0.0 0.8 22 00:06.55 forticron
129 4M 0.0 0.2 8 00:00.00 getty
136 7M 0.0 0.4 15 00:01.50 forticldd
137 6M 0.0 0.4 47 00:00.16 authd [x3]
138 6M 0.0 0.3 24 00:00.20 foauthd
130 122M 0.0 6.5 373 00:30.24 ipsmonitor [x6]
142 16M 0.0 0.9 31 00:06.62 sslvpnd [x4]
143 4M 0.0 0.3 11 00:00.90 info_sslvpnd
144 6M 0.0 0.3 10 00:00.90 guacd
146 4M 0.0 0.3 53 00:02.20 proxyd [x3]
147 6M 0.0 0.3 23 00:00.54 voipd
148 61M 0.0 3.3 182 00:42.47 wad [x8]
149 32M 0.0 1.7 57 00:23.85 scanunitd [x5]
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello Jirko,
I would call it normal, or expected. What FGT with configured FSSO polling do is to read WinSec log in a chunks and then parse that log to find out useful user logon records. That should be done via SMB RPC calls vith help of fssod smbcd and authd .. all those daemons participate in this. So the FSSO collector on FGT (that't what local polling is) cost you a bit of CPU. On low end models it seems to me a bit costly. If I consider that same job and to be honest better job can be done by standalone Collector installed right on DC with plenty of multi-core hyper-threaded CPU raw power.
So to your last question, my answer is 'it's always better to run dedicated standalone collector agent then local polling'.
I thing there was Fortinet KB article about differences but in short what FGT poller does not and standalone Collector Agent (CA) does:
- FGT poller does only WinSec - CA can do 3 types of polling + listen to 2 types of agents + RSSO + Syslog to SSO + Exchange server monitor ...
- FGT without ability to choose which events to poll - in CA you can choose from 3 presets and/or manually specify explicitly for example EventIDs like 4624 only
- resources .. spoke about above
- FGT does not do workstation checks, cache LDAP, have alt.DNS - CA does have all that
So for start-up So-Ho, one DC domain + few <10 users .. or POC lab test, the FGT poller is enough, for anything bigger I'd recommend to use standalone Collector Agent. Which is free of charge part (download from support.fortinet.com from under FortiOS) and resources consumption on DC is supposed to be insignificant.
Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff
Hello Tomas,
Thank you for the explanation. Now I fully understand the situation. So I set up pooling with FSSO collector on DC, Everything OK.
Jirka
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.