1

Troubleshooting serious issue with FSSO - Users not getting access to internet because the primary FSSO agent fails to receive those user log on events. out of 3 agents configured (2 in DC1 and 1 in DC2) the user events are getting updated only in DC2. the collector agents 1 and 2 are not getting complete info and there by users are unable to get online as they are not recognized by fortigate.

now facing the problem to view debug info from collector agents

We have FSSO COllector Agents (3 agents) configured

After enabling debug, view log show still the old logs collected from 2019

Tried increasing the fileize to maximum , still it doesnt show up relevant logs

Please urgent help is needed, any relevant info is really helpful.

1 Answer 1

0

For FSSO you need (I'm assuming Windows servers with Active Directory):

  • a DC Agent on every one domain controller that a user can log into
  • at least one Collector Agent
  • a connection between each DC Agent and each Collector Agent

The key part is that each Collector Agent needs to see every login. The Fortigate only talks to one Collector Agent (the others are redundant) and needs the full reports. I found this part rather poorly documented and had to sort it out in PoC testing.

Make sure that the CA can actually see the DCAs and no firewalls etc. are filtering the traffic.

Also, if logging isn't activated the (old) logs don't update.

1
  • Hi, Thankyou for the response. you got it right,. at present problem is with debugging. We are unable to see current dedug logs its not rewrite/overwriting the logs in collector Agent. The CA has all DCA's listed and no filter too
    – Sivagami N
    May 13 at 9:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.