What is the best choice for FSSO

[fl0at0xff]

Hello,

Which is the best way to use FSSO when I just have one Windows DC ? I saw that it is possible to configure the fortigate only to "query" the AD and nothing has to be installed on the AD. It is a good choice to just install the collector directly on the AD if I just have one AD ? Is the collector useful when there is just one AD ? 

Thank you in advance for your responses

[MikePruett]

A single DC you can just make the FortiGate poll the DC and be on your way.

[gsarica]

We have two DC's and use polling mode only, works as advertised.

[xsilver_FTNT]

Direct polling from FortiGate for two DCs, one domain, few users .. is just fine.

If you are going to need NTLM, workstation checks or different polling methods (like utilize WMI), or you will grow your DC base or number of domains, then I would recommend to use standalone Collector Agent on DC (or domain member server, not necessarily DC). If possible I always prefer external Collector for its variability, scale-ability and robustness.

[fl0at0xff]

Hello all and thank you for your answers. I understand the importance to have a external collector server when you have multiple DC. If I understand correctly, it is possible to install the collector to one external server and then configure it to poll two or more DC right ? With this solution, I just need to "add" this external collector on my fortigate right ?

The other solution, when we have only one DC, is to just configure the fortigate to poll directly the DC right ? But this solution offer less possibilities right ? 

It is possible to install the collector directly on the DC if I have only one DC ? What happens with this solution if I have more than one DC ? I think it depends of configuration of DC architecture... 

[xsilver_FTNT]

Q: Is it possible to install the collector to one external server and then configure it to poll two or more DC right ?

A: Yes, that's exactly the purpose of the collector.

Q: With this solution, I just need to "add" this external collector on my fortigate right ?

A: Yes, 'config user fsso' will point to that Collector.   Q: The other solution, when we have only one DC, is to just configure the fortigate to poll directly the DC right ? But this solution offer less possibilities right ? 

A: Yes and yes.   Q: Is it possible to install the collector directly on the DC if I have only one DC ?

A: Yes

Q: What happens with this solution if I have more than one DC ? I think it depends of configuration of DC architecture...

A: that external (sometimes called "standalone") Collector can collect initial data from multiple sources (DCAgents, TSAgents, Polling [NetAPI,WinSec,WinSec+WMI], RADIUS Accounting, Syslog, Exchange Servers) and with help of LDAP and DNS verify users and create FSSO user records and then based on group filters push necessary/requested/matching users to respective and connected FortiGate(s). That standalone Collector can process multiple DCs or even domains. If needed you can use multiple collectors, either as backup or fail-proof solution or to divide multiple domains or single domain into logical or geographical entities.

For more examples and guides I would strongly recommend to check http://docs.fortinet.com (also see our cookbook library with case studies and step-by-step guides)

[fl0at0xff]

Ok thank for these answers ! In my next case, I just have one DC/AD, so I will just install the Collector on the DC directly. 

What is your opinion about the working mode ? I read that polling mode is better but I don't have enough experience to judge this point. 

Thanks

[xsilver_FTNT]

Hi,

that might be personal, but I do prefer standalone Collector (or FortiAuthenticator as collector, but it's overkill for small site). Running in Advanced mode, so all the group membership is in LDAP syntax format allowing you to know exactly where is the group in structure, also allowing you to use OU as group regardless it's NOT a group, also allows you to nest the group inside the group inside the group etc. And from collecting modes I do prefer WinSec or WinSec+WMI if possible. If the environment is too big for polling times etc. then there is DCAgent mode as the best option.

[Jevgenij]

We have two DC's and use polling mode only, works as advertised.

How many AD users you have? I'm trying to configure same scheme with Forti polling info from 2 DC, but our regional Fortigate distributor said that polling usable only for small organizations where AD users <50.

[xsilver_FTNT]

Hi Jevgenij,

there is no exact limit on how many users does your AD has. However and if possible by any chance, I would suggest to use standalone collector agent in all the cases for its robustness, features, scaleability and reliability.

Small set of hints: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD38897

"Technical Note: FSSO local poller (fssod) limitations compared to FSSO collector agent"

Tomas