Configuring the FSSO Collector agent for Windows AD

Configuring Directory Access settings

The FSSO Collector Agent can access Windows Active Directory in one of two modes:

  • Standard — the FSSO Collector Agent receives group information from the Collector agent in the domain\useformat. This option is available on FortiOS 3.0 and later.
  • Advanced — the FSSO Collector Agent obtains user group information using LDAP. The benefit of this method is that it is possible to nest groups within groups. This is option is available on FortiOS 3.0 MR6 and later. The group information is in standard LDAP format.

If you change AD access mode, you must reconfigure your group filters to ensure that the group information is in the correct format.

 

To configure Directory Access settings:

1. From the Start menu select Programs > Fortinet > Fortinet Single Sign On Agent > Configure Fortinet

Single Sign On Agent.

2. In the Common Tasks section, select Set Directory Access Information.

The Set Directory Access Information dialog box opens.

3. From the AD access mode list, select either Standard or Advanced.

4. If you selected Advanced AD access mode, select Advanced Setting and configure the following settings and then select OK:

AD server address                    Enter the address of your network’s global catalog server.

AD server port                           The default AD server port is 3268. This must match your server port.

BaseDN                                      Enter the Base distinguished name for the global catalog. This is the point

in the tree that will be considered the starting point by default-See following example.

Username                                  If the global catalog accepts your Fortinet Single Sign On Agent agent’s cre- dentials, you can leave these fields blank. Otherwise, enter credentials for

Password

BaseDN example an account that can access the global catalog.

An example DN for Training Fortinet Canada is ou=training, ou=canada, dc=fortinet, dc=com. If you set the BaseDN to ou=canada, dc=fortinet, dc=com then when Fortinet Single Sign On Agent is looking up user credentials, it will only search the Canada organizational unit, instead of all the possible countries in the company. Its a short cut to entering less information and faster searches.

However, you may have problems if you narrow the BaseDN too much when you have international employees from the company visiting different offices. If someone from Fortinet Japan is visiting the Canada office in the example above, their account credentials will not be matched because they are in ou=japan, dc=fortinet, dc=com instead of the BaseDN ou=canada, dc=fortinet, dc=com. The easy solution is to change the BaseDN to simply be dc=fortinet, dc=com. Then any search will check all the users in the company.

 

Configuring the Ignore User List

The Ignore User List excludes users that do not authenticate to any FortiGate unit, such as system accounts. The logons of these users are not reported to FortiGate units. This reduces the amount of required resources on the FortiGate unit especially when logging logon events to memory.

 

To configure the Ignore User List:

1. From the Start menu select Programs > Fortinet > Fortinet Single Sign On Agent > Configure Fortinet

Single Sign On Agent.

2. In the Common Tasks section, select Set Ignore User List.

The current list of ignored users is displayed:

3. Do any of the following:

  • To remove a user from the list, select the the username and then select Remove. The user’s login is no longer ignored.
  • To add users to be ignored,
  • enter the username in the format domain\username and select Add or
  • select Add Users, an Add Ignore Users window is displayed, checkmark the users you do not want to monitor, then select Add or
  • select Add by OU, an Add Ignore Users by OU window is displayed, select an OU from the directory tree, then select Add. All users under the selected OU will be added to the ignore user list.

4. Select OK.

 


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

This entry was posted in FortiOS 5.4 Handbook and tagged , , , on by .

About Mike

Michael Pruett, CISSP has a wide range of cyber-security and network engineering expertise. The plethora of vendors that resell hardware but have zero engineering knowledge resulting in the wrong hardware or configuration being deployed is a major pet peeve of Michael's. This site was started in an effort to spread information while providing the option of quality consulting services at a much lower price than Fortinet Professional Services. Owns PacketLlama.Com (Fortinet Hardware Sales) and Office Of The CISO, LLC (Cybersecurity consulting firm).

4 thoughts on “Configuring the FSSO Collector agent for Windows AD

  1. Khan

    hello,
    the domain controller on which fsso agent is installed could be in any vlan forexample, fortigate firewall is vlan 60 and DC on which agent is installed in vlan 50 and intervlan routing is enables we can ping the firewall from the domain controller but in this setup of different vlan the fsso agent should work with fortigate without any problem because there is L3 communication between them. i have issue the collector agent doesn’t track the domain logon users and ipv4 policy in fortigate based on fsso agent groups is not working and i cant keep both agent and firewall in same vlan they are in different vlans but this shouldnt be an issue. please advise as i am tired of debugging and fortigate TAC is also not taking this issue serious. if anyone could help please…
    Regards

    Reply
  2. Lee

    Hi Khan

    FGT connect to FFSO agent via TCP port 8000 by default. As long as you allow traffic from vlan60 to vlan 50 with this port, the communication should be established

    You can verify server status via CLI commands

    FGT-VM-ESX-Router # diagnose debug enable
    FGT-VM-ESX-Router # diagnose debug authd fsso server-status
    FGT-VM-ESX-Router #
    Server Name Connection Status Version
    ———– —————– ——-
    FSSO connected FSAE server 1.1

    Hth

    Lee

    Reply
  3. Nuno

    Hi,

    I´m having this issue, on my fortigate de SSO Server is disconnected and on FSSO Agent there are 0 fortigate connected. I already configured the LDAP Server and it´s working . Does anyone have any idea?

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.