TS Agent : users not using affected ports

[whinpo]

Hi,

We're testing the TS Agent 5.0.242

The user is authenticated, the agent sees the proper groups, recognizes a TS login and the log shows that a port range has been allocated.

But when the user tries to access Internet, the ports used are totally different (> 49152, the standard dynamic ports, when the conf was speaking about 20000+)

The dynamic port allocation doesn't work, so the user can't acces Internet.

The server is a freshly installed Win2k8 sp2  with all updates and nothing else than TS services (no firewall, nothing).

I've open an issue but nothing efficient came from that for the moment...

Any idea ?

[gavinm]

Hi,

Just ran into the same problem. Managed to fix it though not sure exactly which of these did it, but maybe you can give this a try:

-Use the .exe not the .msi to install - I have a feeling this may be it

-Use the TS and Collector agent version that matches your Fortigate (Not sure why this would make any difference though) - i.e. For Firmware 5.2.4 use agents version 5.0.0241

-In the Collector Agent, uncheck the Advanced Settings->Citrix/Terminal Server Virtual IP - default is unchecked but for some reason I thought it was required - haven't read up to see what it actually does though

-I also used 'Standard' mode on the Collector when it wasn't working. I switched to 'Advanced' mode and did the above at the same time, but I don't think this would make a difference.

HTH

[xsilver_FTNT]

Hello gentlemen.

@whinpo

described behavior where traffic is originated from system ports instead of user assigned ports is usually result of some sort of proxy in the system. Maybe some security application trying to do HTTP protection/scan. It will terminate customer connection on itself, scan and then open new connection to actually gather data requested by user. But in this case new, outer, connection will be opened by proxy and not by user, and proxy is most probably running as system service => system ports used. Check that browser do not has any proxy set, and there is not any transparent proxy in system.

netstat -aonb >c:/portsused.txt This command and flow debug on FortiGate could help you to identify which application is using which port range so if you on FortiGate see traffic flowing and failing auth from system ports, check who is using those ports.

@gavinm

Collector agent mode of operation (Standard vs Advanced) is just about the format in which group membership will be.

Standard does use MS format of DOMAIN/GROUP.

Advanced uses LDAP format CN=group,OU=Users,DC=example,DC=com

You have to be aware of that and make sure that FortiGate and Collector does use same format. Otherwise Group Filters will not match and you will have users on Collector but not on FortiGate etc.

When you attach LDAP to FSSO Agent on FortiGate config, then FortiGate will start to use LDAP format and push the selected groups to Collector as Group Filter. On Collector you can see that Group Filter is pushed from certain FrotiGate (SN bind).

Kind regards,

Tomas

[whinpo]

hi :)

thanks for your answers.

We've made many tries, even modifying some registry or netsh values.

It seems I've found the reason for the issue : a service called ffsota is unable to start

In event viewer we can see :

System error 577 has occured

Windows cannot verify the digital signature for this file. A recent hardware or software change might....

i've reported it to support and meanwhile we'll try with an older version of the agent.

i'll keep you informed ;)

regards

[whinpo]

We've installed the V5.0.0241 and it's workingwith Firmware 5.2.5 and Windows 2008

It seems the issue is in the way the prog was built :)

[MrSinners]

Recently installed agent version TSAgent_Setup_5.0.0250.exe for a customer on a Windows 2008 R2 Server for Citrix. The issue with the verification of the digital signature is still present! Furthermore, this issue is nowhere mentioned in the Fortinet bug tracker or release notes. Fortinet support replied with "Developers should publish repaired build (signed with correct certificate) soon". We are now using agent TSAgent_Setup_5.0.0241.exe on the Win 2008 R2 Server which is working fine. Version 250 does work on a Windows 2012 R2 Server.