FSSO randomly stop working?

[mcuric]

Hello,

We have Fortigate 100D and we need all connections to be authenticated to AD. FSSO is setup by Fortinet SSO agent and agents are installed on all 3 domain controlers. In AD we made 4 groups and users are members of one of those groups and agent is setup to monitor those groups. In FTG we made group type FFSO and member for each group in FTG is related group in AD. Multiple policy has been made with varius settings of web/aplication/email fltering and service for each group.

And this setup works just fine. All users are authenticated, and going out by their policy. So everything is working as it should.

Until 2-3 days ago i got report from user that his internet is not working? Checked that user, really it is not. I cant even ping outside (every rule has enabled ping). I can get to fortigate, ping it just fine, but outside i cannot. I made one test rule with just that IP of user but without FSSO, works like charm. Disable/delete rule (so standard rule would apply with FSSO) not working.

Now interesting part. I checked log and i see that that specific machine is conneting to fortigate with no user information. Just IP. If i log off and log on (not even restart of machine), everything works as normal? Like it lost "token" of authentication with AD and with relog it acquire it again and everything works.

Now 2 days has passed, and more random users report same behavior. Totaly random. Some users never have this problem. Some happen every day, some every 3-4 hours, some clients are XP, some windows 7 or 8, or even 2008 R2 server.

AD is windows 2008 R2, FTG agent is installed on all 3 servers, working as it should, clients are mix of windows XP, W7, W8.

Memory on FTG is around 40%, never over 50%, disk is maybe 5%, and procesor is around 5-15% top. Firmware is v5.2.3,build670

Any toughts?

Thx!

Mario

[mcuric]

So noone has any idea?

[timwagner]

Hi Mario,

we're currently facing an issue with the same error indicators. Since 4-5 weeks users lost their "internet connection" but internal traffic is not affected. 

The issue pertains either normal desktop pc user as users working via terminal server. 

Did you made any progress resolving the issue?

We're using a Fortigate 200D Cluster with 5.0.11 

Best regards,

Tim

[Silver]

Hi,

Anyone found solution for this issues.

Thanks

[Hassan_Fahmy]

Any Update !!!

[Pedro_Panizzon]

Hi,

Mcuric, maybe you noticed that for example: Try to suppose that the work time in this scenario is commercial, i mean, 08:00 - 18:00.

When users arrive at work and make their logon, obviously the sessions will be opened in FortiGate, to allow users browser through FSSO. Please verify if the "lost of connectivity" problem happens around 16:00 - 17:00.

So, is the "no user" identity N/A or "Guest"?

If that's the case there, it means that approximately each 8 hours, the sessions are been killed by FortiGate. In this case is one parameter that should be set according to your firm profile.

If yo're using FSSO in Polling Mode, just run these commands:

# config user fsso-­polling # edit <ID> # set logon­-history <int> (0­ - 48, default is 8(Time that the session are valid before expire), 0 means you will keep the history of sessions as long the FortiGate still running, and in this case, you must choose this option.) # end

Hope that works!.

[enemach]

I have the exact same issue as mcuric. Some users randomly lose the ability to authenticate to FSSO. They will no longer be allowed through policies which users are identified with FSSO. A reboot fixes the issue. Anyone else having this issue?

PS - I don't use 'polling mode' so i don't believe what Pedro Pannizon described will help me. 

[CSD]

We are a school district and we are also having this issue.  We noticed that this started after the last update and were wondering if anyone else had just updated? also being a school district we don't want the user to be remembered since students change every hour. 

[enemach]

Update: After some troubleshooting we have noticed one of our domain controllers did not have the FSSO dc-agent.dll installed. None of the user logon/authentication events were being collected from that domain controller. We have 5 domain controllers and with one not having the FSSO dc-agent, users had a 20% failure rate. We believe this solved our issue.

Also, we have noticed when our IT staff uses remote tools to log into user computers to troubleshoot we experience issues with FSSO. I assume this is a common issue. The IT staff's successful authentication from a users IP will change the FSSO group membership. We are investigating putting the IT users into the 'ignore users' list on the collector. We are still ironing those details out.