Configuring FSSO Advanced Settings

Enabling guest access through FSSO security policies

You can enable guest users to access FSSO security policies. Guests are users who are unknown to the Windows AD or Novell network and servers that do not logon to a Windows AD domain.

To enable guest access in your FSSO security policy, add an identity-based policy assigned to the built-in user group SSO_Guest_Users. Specify the services, schedule and protection profile that apply to guest users — typically guests receive reduced access to a reduced set of services. Creating security policies on page 590


FortiOS FSSO log messages

There are two types of FortiOS log messages — firewall and event. FSSO-related log messages are generated from authentication events. These include user logon and log off events, and NTLM authentication events. These log messages are central to network accounting policies, and can also be useful in troubleshooting issues. For more information on firewall logging, see “Enabling security logging”. For more information on logging, see the FortiOS Handbook Log and Reporting guide.


Enabling authentication event logging

For the FortiGate unit to log events, that specific type of event must be enabled under logging.

When VDOMs are enabled certain options may not be available, such as CPU and memory usage events. You can enable event logs only when you are logged on to a VDOM; you cannot enable event logs globally.

To ensure you log all the events need, set the minimum log level to Notification or Information. Firewall logging requires Notification as a minimum. The closer to Debug level, the more information will be logged. While this extra information is useful, you must


To enable event logging:

1. Go to Log&Report > Log Config > Log Settings.

2. In Event Logging, select:

System activity event               All system-related events, such as ping server failure and gateway status.

User activity event                    All administration events, such as user logins, resets, and configuration updates.

3. Optionally you can enable any or all of the other logging event options.

4. Select Apply.


Authentication log messages

List of FSSO related log messages


Message ID Severity Description





Authentication was successful






Authentication session failed






Authentication locked out






Authentication timed out






FSSO authentication was successful






FSSO authentication failed






FSSO user logged on






FSSO user logged off






NTLM authentication was successful






NTLM authentication failed


For more information on logging, see the FortiOS Handbook Log and Reporting guide.

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Don't Forget To visit the YouTube Channel for the latest Fortinet Training Videos and Question / Answer sessions!
- FortinetGuru YouTube Channel
- FortiSwitch Training Videos

Cybersecurity Videos and Training Available Via: Office of The CISO Security Training Videos