Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
aousien
New Contributor II

FSSO DC agent cannot get DNS name of domain

Hello , 

 

I have DC agent installed on the Domain Controller, and FAC debug indicate that it's getting the user and workstation details, but that it cannot resolve the DNS name for the workstation domain 

error below from FAC FSSO debug ( FAC is acting as collector agent )

 

any ideas or tips on where to look?

the workstation domain name is like mydomain.subdomain.local, so I have added subsomain.local to the DNS suffix in the DC agent config page, but still with no luck. appreciate anyone's help. Thanks


01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: decoded workstation: WKS01
01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: decoded domain: MYDOMAIN
01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: decoded user: userx
01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: has 0 ipv6 address
01/21/2022 15:32:04 [F4555555] DC/TS Agent [WARN]: cannot get DNS name of domain MYDOMAIN from Domain Manager
01/21/2022 15:32:04 [F4555555] DC/TS Agent [WARN]: Failed to decode DCTSA packet from 10.119.216.31:56581

1 Solution
Sx11
Staff
Staff

Hi,

 

what events do you get from the Domain Manager debug logs?

You can check at https://<FortiAuthenticator-IP-Address>/debug

On the top left services select FSSO Domain Manager.

Check the timestamp to see events that correlate to the events in DC/TS Agent service.

 

When you select "FSSO Domain Manager" service you also get a function on the GUI named "Rebuild SSO domains". If you enable this it will generate new events related to the status of the Domain Manager and you could get more information on the issue.

 

More information on troubleshooting here:

https://docs.fortinet.com/document/fortiauthenticator/6.0.7/administration-guide/120058/debug-logs#D...

 

Regards,

S

sx11

View solution in original post

2 REPLIES 2
Sx11
Staff
Staff

Hi,

 

what events do you get from the Domain Manager debug logs?

You can check at https://<FortiAuthenticator-IP-Address>/debug

On the top left services select FSSO Domain Manager.

Check the timestamp to see events that correlate to the events in DC/TS Agent service.

 

When you select "FSSO Domain Manager" service you also get a function on the GUI named "Rebuild SSO domains". If you enable this it will generate new events related to the status of the Domain Manager and you could get more information on the issue.

 

More information on troubleshooting here:

https://docs.fortinet.com/document/fortiauthenticator/6.0.7/administration-guide/120058/debug-logs#D...

 

Regards,

S

sx11
xsilver_FTNT
Staff
Staff

Hi aousien,

 

as you mentioned FortiAuthenticator (FAC) as the collector being listening to DC Agent (installed on AD/DC), then I assume you have FAC / GUI / Fortinet SSO Methods / SSO / General / "Enable DC/TS Agent Clients" enabled.

 

And so FAC / GUI / Monitor / SSO / "DC/TS Agents" shows your DC Agent connected.

Also .. SSO / Domains shows your AD domain and structure and individual DCs as green.

If that second part (Domain monitor) is not OK, then check <FAC-IP-FQDN>/debug/domain-manager/ log for any connection errors.

Domain manager gets this info from either Fortinet SSO Methods / SSO / Windows Event Log Sources (if you would do DC polling). But as you claimed using DCAgents, then your possible source might be FAC / GUI / Authentication / Remote Auth. Servers / LDAP setting with bond to Active Directory Domain via "Windows Active Directory Domain Authentication" setting inside LDAP server setup.

Properly set up DNS is crucial part of SSO. I just guess that your AD/DC is also your DNS server, but that could be separate server or even non-Microsoft DNS (like Bind).
So another thing to help with resolution is FAC / GUI / System / Network / DNS  having one of set DNS  servers set/pointing to AD/DNS, or your actual DNS server.

Another thing to help is actual DC Agent, as by default it will try to resolve hostnames gathered from logon attempts in LSAS via local OS in which it is installed.
DCAgent hostnames resolution capability is controlled by those self-explanatory registry keys "donot_resolve" and "Domain_DNSsuffix" in [HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FSAE\dcagent] .

 

 

Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff

Labels
Top Kudoed Authors