FortiManager and FSSO agents

[Roysmith]

Hi

Looking for some advice, if anyone can help. We have a few remote sites each with a Fortigate HA cluster with ADVPN connetivity between the sites. We have a Fortimanager at our primary site which as also managing some of the remote sites but not all of them. We also have a FSSO server at the primary site and 2 of the remote sites. So, I went through the process of adding the Fortigate at one of these remote sites to FortiManager. for the most part it went ok but we have had issues with the FSSO agents.

The import process imported ther SSO agent settings from the remote site. What we discovered was that this had a couple of duplicate entries, that were also on the primary FSSO agent. I am referring the configuration in FortiManager at Object Configurations > Fabric Connectors > Endpoint/Identity.

What we found is that the 2 FSSO agents cannot have the same groups or users in them. If you add a duplicate entry it disappears from the other agent. Also, when pushing policy, the installation wizard attempted to create or edit the new FSSO agent. However, as the source-ip is using a local IP on the Fortigate, the remote one would fail, as that source-ip does not exist on the local Fortigate.

Has anyone had any similar issues?

This also begs the question - Can you have multiple FSSO agents configrued in FortiManager, even when they across multiple sites and behind remote gateways?

Hope that makes sense to someone and if anyone can shed some light on this, that would be greatly appreciated.

Many Thanks
Roy

[Anthony_E]

Hello Roy,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[katenshw]

No problems with the FSSO object pointing to two Collectors - the local + one elsewhere (e.g. central). Up to five can be set. Just be aware that Collectors do not synchronize tables between each other, so they are not expected to ever have exactly equal content (but over time they are expected to be approximately equal). Also keep in mind that they are used in fail-over fashion - the FortiGate is always connnected to only one Collector https://tutuapp.uno/ .

[Roysmith]

Hi Katenshw

I may be getting mixed up with the Fortinet terminology here so excuse me if I complicates things. 

I have no issues with have 1 FSSO object pointing to 2 or more collector servers. In fact I can see the advantage in that. The fact that you can have up to 5 collectors specified should provide the required resiliency.

However, my issue with just having 1 FSSO object in FortiManager is the source-ip of that object. This source-ip only exists on 1 of the gateways, so when a policy install is done on another gateway, the policy fails due the source-ip not existing. If I remove the source-ip entry, it appears to replace it with 0.0.0.0. Anyway, if I do this, user authentication fails on the gateway. Why do I need to specify a source-ip? Is there a way to get around it? How do I get to install that object on multiple gateways?

Thanks

Roy