Hot!What is the best choice for FSSO

Author
fl0at0xff
Bronze Member
  • Total Posts : 39
  • Scores: 0
  • Reward points: 0
  • Joined: 2016/08/23 00:13:56
  • Status: offline
2016/11/01 10:10:14 (permalink) 5.4
0

What is the best choice for FSSO

Hello,
Which is the best way to use FSSO when I just have one Windows DC ? I saw that it is possible to configure the fortigate only to "query" the AD and nothing has to be installed on the AD. It is a good choice to just install the collector directly on the AD if I just have one AD ? Is the collector useful when there is just one AD ? 
 
Thank you in advance for your responses
#1

11 Replies Related Threads

    MikePruett
    Platinum Member
    • Total Posts : 677
    • Scores: 15
    • Reward points: 0
    • Joined: 2014/01/08 19:39:40
    • Location: Montgomery, Al
    • Status: offline
    Re: What is the best choice for FSSO 2016/11/01 11:45:33 (permalink)
    0
    A single DC you can just make the FortiGate poll the DC and be on your way.

    Mike Pruett
    Fortinet GURU
    #2
    gsarica
    Bronze Member
    • Total Posts : 60
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/07/28 13:23:52
    • Status: offline
    Re: What is the best choice for FSSO 2016/11/01 12:08:22 (permalink)
    0
    We have two DC's and use polling mode only, works as advertised.
    #3
    xsilver_FTNT
    Expert Member
    • Total Posts : 392
    • Scores: 63
    • Reward points: 0
    • Joined: 2015/02/02 03:22:58
    • Status: offline
    Re: What is the best choice for FSSO 2016/11/02 01:36:43 (permalink)
    0
    Direct polling from FortiGate for two DCs, one domain, few users .. is just fine.
    If you are going to need NTLM, workstation checks or different polling methods (like utilize WMI), or you will grow your DC base or number of domains, then I would recommend to use standalone Collector Agent on DC (or domain member server, not necessarily DC). If possible I always prefer external Collector for its variability, scale-ability and robustness.

    Kind Regards,
    Tomas
    #4
    fl0at0xff
    Bronze Member
    • Total Posts : 39
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/08/23 00:13:56
    • Status: offline
    Re: What is the best choice for FSSO 2016/11/02 05:05:37 (permalink)
    0
    Hello all and thank you for your answers. I understand the importance to have a external collector server when you have multiple DC. If I understand correctly, it is possible to install the collector to one external server and then configure it to poll two or more DC right ? With this solution, I just need to "add" this external collector on my fortigate right ?
     
    The other solution, when we have only one DC, is to just configure the fortigate to poll directly the DC right ? But this solution offer less possibilities right ? 
     
    It is possible to install the collector directly on the DC if I have only one DC ? What happens with this solution if I have more than one DC ? I think it depends of configuration of DC architecture... 
    #5
    xsilver_FTNT
    Expert Member
    • Total Posts : 392
    • Scores: 63
    • Reward points: 0
    • Joined: 2015/02/02 03:22:58
    • Status: offline
    Re: What is the best choice for FSSO 2016/11/02 06:16:57 (permalink)
    5 (1)
    Q: Is it possible to install the collector to one external server and then configure it to poll two or more DC right ?
    A: Yes, that's exactly the purpose of the collector.
     
    Q: With this solution, I just need to "add" this external collector on my fortigate right ?
    A: Yes, 'config user fsso' will point to that Collector.
     
    Q: The other solution, when we have only one DC, is to just configure the fortigate to poll directly the DC right ? But this solution offer less possibilities right ? 
    A: Yes and yes.
     
    Q: Is it possible to install the collector directly on the DC if I have only one DC ?
    A: Yes
     
    Q: What happens with this solution if I have more than one DC ? I think it depends of configuration of DC architecture...
    A: that external (sometimes called "standalone") Collector can collect initial data from multiple sources (DCAgents, TSAgents, Polling [NetAPI,WinSec,WinSec+WMI], RADIUS Accounting, Syslog, Exchange Servers) and with help of LDAP and DNS verify users and create FSSO user records and then based on group filters push necessary/requested/matching users to respective and connected FortiGate(s). That standalone Collector can process multiple DCs or even domains. If needed you can use multiple collectors, either as backup or fail-proof solution or to divide multiple domains or single domain into logical or geographical entities.
     
    For more examples and guides I would strongly recommend to check http://docs.fortinet.com (also see our cookbook library with case studies and step-by-step guides)

    Kind Regards,
    Tomas
    #6
    fl0at0xff
    Bronze Member
    • Total Posts : 39
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/08/23 00:13:56
    • Status: offline
    Re: What is the best choice for FSSO 2016/11/02 09:57:58 (permalink)
    0
    Ok thank for these answers ! In my next case, I just have one DC/AD, so I will just install the Collector on the DC directly. 
     
    What is your opinion about the working mode ? I read that polling mode is better but I don't have enough experience to judge this point. 
     
    Thanks
    #7
    xsilver_FTNT
    Expert Member
    • Total Posts : 392
    • Scores: 63
    • Reward points: 0
    • Joined: 2015/02/02 03:22:58
    • Status: offline
    Re: What is the best choice for FSSO 2016/11/03 07:17:00 (permalink)
    0
    Hi,
    that might be personal, but I do prefer standalone Collector (or FortiAuthenticator as collector, but it's overkill for small site).
    Running in Advanced mode, so all the group membership is in LDAP syntax format allowing you to know exactly where is the group in structure, also allowing you to use OU as group regardless it's NOT a group, also allows you to nest the group inside the group inside the group etc.
    And from collecting modes I do prefer WinSec or WinSec+WMI if possible. If the environment is too big for polling times etc. then there is DCAgent mode as the best option.

    Kind Regards,
    Tomas
    #8
    Jevgenij
    New Member
    • Total Posts : 2
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/11/08 12:37:44
    • Status: offline
    Re: What is the best choice for FSSO 2016/11/09 05:05:19 (permalink)
    0
    We have two DC's and use polling mode only, works as advertised.

     
    How many AD users you have? I'm trying to configure same scheme with Forti polling info from 2 DC, but our regional Fortigate distributor said that polling usable only for small organizations where AD users <50.
    #9
    xsilver_FTNT
    Expert Member
    • Total Posts : 392
    • Scores: 63
    • Reward points: 0
    • Joined: 2015/02/02 03:22:58
    • Status: offline
    Re: What is the best choice for FSSO 2016/11/10 02:48:10 (permalink)
    0
    Hi Jevgenij,
    there is no exact limit on how many users does your AD has. However and if possible by any chance, I would suggest to use standalone collector agent in all the cases for its robustness, features, scaleability and reliability.
     
    Small set of hints: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD38897
    "Technical Note: FSSO local poller (fssod) limitations compared to FSSO collector agent"
     
    Tomas

    Kind Regards,
    Tomas
    #10
    sotir1984
    Bronze Member
    • Total Posts : 22
    • Scores: 0
    • Reward points: 0
    • Joined: 2017/02/21 09:05:56
    • Status: offline
    Re: What is the best choice for FSSO 2018/12/18 04:38:12 (permalink)
    0
    Hi,
     
    Is there a limit on how many DC's can you poll directly from FortiGate?
     
    -Sotir-
    #11
    xsilver_FTNT
    Expert Member
    • Total Posts : 392
    • Scores: 63
    • Reward points: 0
    • Joined: 2015/02/02 03:22:58
    • Status: offline
    Re: What is the best choice for FSSO 2018/12/18 05:04:04 (permalink)
    0
    Well .. there are limits governed by max. values table .. but in fact I would not poll from FGT at all, or for very, very small domain environment. Let's say one DC.
    Use standalone Collector Agent on DC or any domain member to do WinSec+WMI polling, or DCAgent, or mix of polling and DCAgent. That's much better and more scale-able solution. And Collector is distributed free of charge alongside with FortiOS on support portal.

    Kind Regards,
    Tomas
    #12
    Jump to:
    © 2019 APG vNext Commercial Version 5.5