FW policy with FSSO / DC agent

[doncacciatoconsuting]

We are doing FSSO on a gate. I have DC agents on the AD servers.  In the external connector FSSO Agent, the user group source is set to Local LDAP with proactive retrieval enabled. The gate sees all the users, no problem there. In my FW policy we want to allow ALL authenticated users. What is the most scalable way to accomplish this without having to manually add new individual users to a defined group or directly to the policy? Would changing the config from Local LDAP to Collector Agent work ? Thanks for any help here.

[rosatechnocrat · Accepted solution]

You can use Active directory top level group under which all users are specified and can directly call that group in Firewall policies. Please visit the below link for more details. 

https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/795593/use-active-directory-objects-dir...