Configuring FSSO Advanced Settings

Enabling guest access through FSSO security policies

You can enable guest users to access FSSO security policies. Guests are users who are unknown to the Windows AD or Novell network and servers that do not logon to a Windows AD domain.

To enable guest access in your FSSO security policy, add an identity-based policy assigned to the built-in user group SSO_Guest_Users. Specify the services, schedule and protection profile that apply to guest users — typically guests receive reduced access to a reduced set of services. Creating security policies on page 590

 

FortiOS FSSO log messages

There are two types of FortiOS log messages — firewall and event. FSSO-related log messages are generated from authentication events. These include user logon and log off events, and NTLM authentication events. These log messages are central to network accounting policies, and can also be useful in troubleshooting issues. For more information on firewall logging, see “Enabling security logging”. For more information on logging, see the FortiOS Handbook Log and Reporting guide.

 

Enabling authentication event logging

For the FortiGate unit to log events, that specific type of event must be enabled under logging.

When VDOMs are enabled certain options may not be available, such as CPU and memory usage events. You can enable event logs only when you are logged on to a VDOM; you cannot enable event logs globally.

To ensure you log all the events need, set the minimum log level to Notification or Information. Firewall logging requires Notification as a minimum. The closer to Debug level, the more information will be logged. While this extra information is useful, you must

 

To enable event logging:

1. Go to Log&Report > Log Config > Log Settings.

2. In Event Logging, select:

System activity event               All system-related events, such as ping server failure and gateway status.

User activity event                    All administration events, such as user logins, resets, and configuration updates.

3. Optionally you can enable any or all of the other logging event options.

4. Select Apply.

 

Authentication log messages

List of FSSO related log messages

 

Message ID Severity Description
 

43008

 

Notification

 

Authentication was successful

 

43009

 

Notification

 

Authentication session failed

 

43010

 

Warning

 

Authentication locked out

 

43011

 

Notification

 

Authentication timed out

 

43012

 

Notification

 

FSSO authentication was successful

 

43013

 

Notification

 

FSSO authentication failed

 

43014

 

Notification

 

FSSO user logged on

 

43015

 

Notification

 

FSSO user logged off

 

43016

 

Notification

 

NTLM authentication was successful

 

43017

 

Notification

 

NTLM authentication failed

 

For more information on logging, see the FortiOS Handbook Log and Reporting guide.


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.