fortinet 300D dont see logon user OSX

[traposama]

hi!!!!

I have one fortinet 300D firmware 5.4.3 and have 2 imac with osx sierra. There are logon into AD without problem.

Few days ago into FSSO review the logon users and dont see any users ... change de standar to advance option in Set Directory Access Information and Fortinet work again with all AD users but users logon in OSX i dont see...

Have some info for check or fix this!?

Thx.

[xsilver_FTNT]

Hi,

just be aware that switching between Standard and Advanced mode also changes the way the Collector Agent (CA) resolve and reports group membership to connected FortiGates. Which might easily revert your currently applied filters not matching and break the FSSO setup. Easily.

Basically:

- if you set group filters from FGT via used LDAP bond to FSSO Agent config, then group membership will be in LDAP format (CN=group,DC=example,DC=com). If your CA runs in Advanced mode it gathers groups also in LDAP format. Match. As bonus your FGT will set AD groups in FGT and push those as group filter specific for that FGT into CA.

- if you set groups in CA, then CA will try to push groups into FGT. If FGT has FSSO Agent without LDAP it will accept the groups from CA. Useful if you have many FGT units and would like to push same filters everywhere from a single CA, so make it default filter on CA and let it be pushed.

- if CA runs in Standard it uses Microsoft format DOMAIN/GROUP, while in Advanced it uses LDAP notation format.

- Advanced / LDAP format brings advantage of nested groups possible and also produce clean overview where is the group in AD. Cost is longer format, less compact and harder to read.

MAC OSX users.

Usual FSSO deployment uses default set of MSFT Windows EventIDs to process. It usually works when CA does WinSec polling mode + Advanced settings / Event IDs to poll set to 1.

But it might happen not to work in your environment. In that case contact support, open a trouble ticket and try to find out what events are generated in Windows Security Log (WinSec) when MAC OSX user logs in.

Best regards,

Tomas

[traposama]

HI!!

i use DC Agent deploy. The AD is update with 2012R2.

Is possible with last MS hotfix break CA!?

switch from standar to advance work fine and fortinet see the user again...

Thx

[xsilver_FTNT]

Hi,

if you had filters in LDAP format and run CA in Standard then filters were not matching which resulted in no FSSO users seen on FGT. So if you switched CA to Advanced mode in such situation then it is expected to resolve the issue.

If you still do not see MAC OSX users, switch the mentioned Advanced setting. Or even try to temporarily switch CA to WinSec polling. If it's still no-go, then look after the created EventLog IDs in EventLog Viewer .. check the IDs produced by MAC logon. Then there was KB on kb.fortinet.com showing the list of processed IDs on CA in each mode. Check if those generated by MAC access are one of processed.

Kind regards,

Tomas

[traposama]

HI!

let me search the KB...

And try from standar to advance or advance to standar and dont see mac users. In the security logs detect kerberos call from imac...

searching why this happen now...

[xsilver_FTNT]

Hi,

use advanced mode of Collector, optionally switch from basic "0" to extended "1" logon set, and make sure the logon is seen on that Collector first.

If not, then check on MAC which DC was used to login and there check which MSFT EventID was generated.

Compare found ID with list. Maybe you'll need to switch Collector from DCAgent to WinSec polling mode.

Tom