user authentication in agentless

[SFW]

Hi Friends,

I need some help and I hope you all will assist me.

I have a problem with a FortiGate firewall. I’m using FSSO (Fortinet Single Sign-On) in agentless mode to communicate with the Active Directory (AD) server for user authentication.

The AD server is located at the data center (DC), and the users are located at branch offices.

Note:

• LDAP connection status is up

• IPsec tunnel is up

• SD-WAN is also properly established

But the problem is:
Users are not being authenticated properly. Sometimes they get authenticated, but within seconds or minutes, they become unauthenticated again.

I have already checked the AD connection from the branch firewall, and communication is working (SYN-ACK is happening), but still, there’s a problem with authentication.

To resolve this temporarily, I have to restart the user’s system repeatedly.
Due to company policies, I cannot use agent-based authentication.

Please help me with a solution.

[AEK]

Hi SFW

It is not to share bad news but I had no good experience with Agentless FSSO. I don't know if it worked well for someone but for me it is almost useless.

The good news is that there is a method called "Collector Agent Mode" that works very well without the need to install anything on the DC.

It just needs to configure a service account with some privilege:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restricting-a-Fortinet-Single-Sign-On-Agen...

[SFW]

Dear Fortinet team,
Can you please suggest the solution on the above Issue 
looking forward your Response 

Thanks 

[Debbie_FTNT]

Dear SFW,

as AEK already mentioned above, the agentless setup with FortiGate polling can be finicky and is rather limited in functionality, so it never work as you are looking to set it up.

I'm uncertain why users would be removed after a moment - based on the timestamp, it seems to be 60 seconds. Are users always removed after 60 seconds? If yes, it may be some  kind of timeout on FortiGate - did you have a look at a configuration backup of your FortiGate to see if any specific timeouts are defined?

Aside from that, you mentioned that "Due to company policies, I cannot use agent-based authentication."

-> does this mean you cannot install agents on domain controllers, or agents in general?

-> because if the issue is with installation to domain controllers, as AEK already mentioned that is in fact not necessary; you can install a Collector Agent on ANY domain-joined host, though it will need permissions similar to FortiGate to access the event logs on domain controllers and read the login events.

Cheers,

Debbie