Yes, it is normal. FortiGate is connected to just one Collector Agent at a time. In case the Collector Agent or the DC fails, FortiGate will switch to the other Collector Agent specified in config user fsso. To see if it connects to the one you are talking about is to stop or restart the fsso service on the one that is connected to now. FortiGate will see it is not available and will attempt to contact and connect to the " secondary Collector Agent IP" For this reason it is a good idea to have all Collector Agent' s configuration synced. When the failover happens, nobody should notice anything at all.
I am going through my first FSSO setup right now and curious about a few things here.
Is it possible to setup the following. I have 2 fortigate 800C' s not in HA (two seperate units dont ask...), and a Primary and Secondary DC
-points to primary DC that has both DC Agent and Collector installed. add reg key as suggested to add the IP of the second DC agent on secondary DC
-points to Secondary DC that has both DC agent and Collector installed. Add reg key to add the IP of the first DC agent on Primary DC
why would I do it this way versus
-primary FSSO collector IP to Primary DC with DC Agent and Collector installed
-Secondary FSSO Collector IP to Secondary DC with DC Agent and Collector installed
-primary FSSO collector IP to Secondary DC with DC Agent and Collector installed
-Secondary FSSO Collector IP to Primary DC with DC Agent and Collector installed
I feel like what i wrote as the second setup option makes more sense. No need for reg keys. I would assume as long as you have the correct password to communicate it wont care who its coming from, or will this cause problems in communication?
My secondary fortigate is not active unless my core switches failover to the secondary switches which uses the secondary fortigate so unless its just pinging it to confirm a connection it shouldnt be doing anything else?
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.