SSO direct pooling - unusual traffic and CPU load

[Jirka1]

Hello,

I configured SSO/Identity-Poll Active Directory Server on FGT81E (v6.0.2) against DC W2016 customer. By yesterday, everything worked ok. Today I noticed an unusual traffic on the interface to DC (15Mbps in and 3Mbps out). The FGT CPU is loaded to about 30-50%, and according to the diagnosis the process that causes it is "smbcd" .  I checked the entire network for a loop. Then I disable the SSO on FGTand it all stopped (traffic and CPU load).

When I review the FGT Local Log, I see that FGT sent SMB to DC - see the screenshot

Any idea please? Is it better to use native SSO queries or using FSSO collector installed on DC?

SSO cfg:

config user fsso-polling
    edit 1
        set status enable
        set server "172.28.0.2"
        set default-domain ''
        set port 0
        set user "*****"
        set password ENC G2uc5cCSGI9O4YfmFxE1Tlc93smM******H6J3bA6TqxsQukmYIDRhKeJocDeCOblAjyRLu8+XCTAGMYGoqXp+zAxAiCq0jNhs54szG9gI2XhkEu5qZe/mdxdFBaXCKlnZs/yTEiJOxZqsc4/s1wImzvmPA3g4s5B6mTGRvhI9bv2PXhaELCWgaJvF12WhE4vxQ==
        set ldap-server "SX-PDC"
        set logon-history 8
        set polling-frequency 10
        config adgrp
            edit "CN=Domain Admins,CN=Users,DC=***,DC=local"
            next
            edit "CN=****,CN=Users,DC=***,DC=local"
            next
            edit "CN=Domain Users,CN=Users,DC=***,DC=local"
            next
        end
    next
end

config user fsso
    edit "Local FSSO Agent"
        set server "127.0.0.1"
        set port 8000
        set password ENC T+pj6xGEiSGURtNFUrj+jgBzM66h2xYPJtgMNcywfP+YCzmqcEG1pKHf5nwPXPMO0qY2bmPveBbx3Qt/AmAeKxJTtxrjt9zgDXVbe5Wb9lJQZr9bYW0esEwZK2O3t/XbRsEmg1QjJkT7RqnfEC3ECfDWVNg1hcaQjOpz7Z7krcsZnhDM+5ujSjzc+H0K9L7NdY9how==
        set source-ip6 ::
    next
end

config user ldap

edit "SX-PDC"
set server "172.28.0.2"
set secondary-server ''
set tertiary-server ''
set source-ip 0.0.0.0
set cnid "sAMAccountName"
set dn "dc=****,dc=local"
set type regular
set username "****"
set password ENC 9ewB6iD5d9FEylv+YK75OalgQlVLaeemOhcOG8sTTG8TB+N4b0+Jji6qy0CtXJ2sQcftRZrqb6GUGmFjak99K5wY88FLVyZPu/jN7s4HTXcUqub0cwhxoq0vjEdEvnxPk/wwY//mtLBKafLKqY9/1hsG+GLGBMJza4eNcmB+gBgejeK3J55JfBfABr6HIUh5z5K00Q==
set group-member-check user-attr
set group-search-base ''
set group-filter ''
set secure starttls
set ssl-min-proto-version default
set ca-cert ''
set port 389
set password-expiry-warning disable
set password-renewal disable
set member-attr "memberOf"
set account-key-processing same
set account-key-filter "(&(userPrincipalName=%s)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))"
next
end

 PID RSS ^CPU% MEM% FDS TIME+ NAME
 * 298 7M 49.2 0.4 8 00:02.22 smbcd [x2]
   139 18M 21.3 1.0 11 00:03.65 httpclid [x3]
   127 32M 4.7 1.7 25 01:48.83 httpsd [x6]
   125 34M 0.8 1.8 60 00:35.35 miglogd [x3]
   131 4M 0.0 0.2 11 00:03.59 merged_daemons
   132 7M 0.0 0.4 13 00:00.25 fnbamd
   133 4M 0.0 0.2 12 00:00.80 fclicense
   134 14M 0.0 0.8 22 00:06.55 forticron
   129 4M 0.0 0.2 8 00:00.00 getty
   136 7M 0.0 0.4 15 00:01.50 forticldd
   137 6M 0.0 0.4 47 00:00.16 authd [x3]
   138 6M 0.0 0.3 24 00:00.20 foauthd
   130 122M 0.0 6.5 373 00:30.24 ipsmonitor [x6]
   142 16M 0.0 0.9 31 00:06.62 sslvpnd [x4]
   143 4M 0.0 0.3 11 00:00.90 info_sslvpnd
   144 6M 0.0 0.3 10 00:00.90 guacd
   146 4M 0.0 0.3 53 00:02.20 proxyd [x3]
   147 6M 0.0 0.3 23 00:00.54 voipd
   148 61M 0.0 3.3 182 00:42.47 wad [x8]
   149 32M 0.0 1.7 57 00:23.85 scanunitd [x5]

[xsilver_FTNT]

Hello Jirko,

I would call it normal, or expected. What FGT with configured FSSO polling do is to read WinSec log in a chunks and then parse that log to find out useful user logon records. That should be done via SMB RPC calls vith help of fssod smbcd and authd .. all those daemons participate in this. So the FSSO collector on FGT (that't what local polling is) cost you a bit of CPU. On low end models it seems to me a bit costly. If I consider that same job and to be honest better job can be done by standalone Collector installed right on DC with plenty of multi-core hyper-threaded CPU raw power.

So to your last question, my answer is 'it's always better to run dedicated standalone collector agent then local polling'.

I thing there was Fortinet KB article about differences but in short what FGT poller does not and standalone Collector Agent (CA) does:

- FGT poller does only WinSec - CA can do 3 types of polling + listen to 2 types of agents + RSSO + Syslog to SSO + Exchange server monitor ...

- FGT without ability to choose which events to poll - in CA you can choose from 3 presets and/or manually specify explicitly for example EventIDs like 4624 only

- resources .. spoke about above

- FGT does not do workstation checks, cache LDAP, have alt.DNS - CA does have all that

So for start-up So-Ho, one DC domain + few <10 users .. or POC lab test, the FGT poller is enough, for anything bigger I'd recommend to use standalone Collector Agent. Which is free of charge part (download from support.fortinet.com from under FortiOS) and resources consumption on DC is supposed to be insignificant.

[Jirka1]

Hello Tomas,

Thank you for the explanation. Now I fully understand the situation. So I set up pooling with FSSO collector on DC, Everything OK.

Jirka