Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
magnumpi
New Contributor III

fsso with two collectors agent

In a redundant configuration with two collectors agent, is it possible that the same DC agent communicate at the same time with two collectors? thanks
5 REPLIES 5
fropert_FTNT
Staff
Staff

Yes, Simple add a registry key for the second collector agent with its IP address and port under HKEY_LOCAL_MACHINE/SOFTWARE/Fortinet/FSAE/dcagent/ca where the DC Agent is installed.
magnumpi
New Contributor III

great !!! why it is not documented? thanks a lot
magnumpi
New Contributor III

Now the DC Agents pointed to the two Collector Agent, but the second Collector Agent has the " Show Service Status" empty, Why? in this normal? thanks
Alivo__FTNT
Staff
Staff

Hi, Yes, it is normal. FortiGate is connected to just one Collector Agent at a time. In case the Collector Agent or the DC fails, FortiGate will switch to the other Collector Agent specified in config user fsso. To see if it connects to the one you are talking about is to stop or restart the fsso service on the one that is connected to now. FortiGate will see it is not available and will attempt to contact and connect to the " secondary Collector Agent IP" For this reason it is a good idea to have all Collector Agent' s configuration synced. When the failover happens, nobody should notice anything at all.

livo

talkwithphil
New Contributor

Hello, I am going through my first FSSO setup right now and curious about a few things here. Is it possible to setup the following. I have 2 fortigate 800C' s not in HA (two seperate units dont ask...), and a Primary and Secondary DC first fortigate -points to primary DC that has both DC Agent and Collector installed. add reg key as suggested to add the IP of the second DC agent on secondary DC second fortigate -points to Secondary DC that has both DC agent and Collector installed. Add reg key to add the IP of the first DC agent on Primary DC why would I do it this way versus First Fortigate -primary FSSO collector IP to Primary DC with DC Agent and Collector installed -Secondary FSSO Collector IP to Secondary DC with DC Agent and Collector installed Second Fortigate -primary FSSO collector IP to Secondary DC with DC Agent and Collector installed -Secondary FSSO Collector IP to Primary DC with DC Agent and Collector installed I feel like what i wrote as the second setup option makes more sense. No need for reg keys. I would assume as long as you have the correct password to communicate it wont care who its coming from, or will this cause problems in communication? My secondary fortigate is not active unless my core switches failover to the secondary switches which uses the secondary fortigate so unless its just pinging it to confirm a connection it shouldnt be doing anything else? -Phil
IT Security Analyst -Phil
IT Security Analyst -Phil
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors