Forigate and active directory recommendation

[jlmty]

Hi:

I have the following scenario:

-800 users, all of them in an active directory domain, with dynamic ip addresses assigned by dhcp, and computers changing from one vlan/subnet to another in the same day (from one building to another, o switching from Ethernet to wifi, etc).

-6 domain controllers, two in each of 3 active directory sites (on 3 cities linked with redundant ipsec vpn tunnels), Active directory runs over 2008 R2 servers, but functional level 2003.

-We use UTM for web filtering and licensed forticloud for reporting

-Currently running  FortiOS 5.2.10

-Current user authentication in the firewall: None

-We have no experience with fortinet and active directory authentication software or methods.

--------------------------------------------------------------------------------------------------

Project goal: To have better reporting with usernames OR computernames, in order to easily identify the users with security issues, without relaying in active directory DNS name and address consistency regarding computernames and ip addresses.

-------------------------------------------------------------------------------------------------

As far as i understand we need to implement some software on the domain controllers to collect logins, or something like that. But i have read some threads here in the forums about dependencies of active directory´s DNS addresses and names and the user detection behavior. And as far as I can tell, there are different ways or methods to detect authenticated users, so, it doesn´t look easy or trivial thing.

Since i don´t have previous experience with this functionalities, i´m looking for recommendations, points of view or opinions from the ones who have experience in this scenarios. In the past, I’ve seen different software implementations from other manufacturers struggling with the active directory DNS inconsistency, and I’m not sure about the advantages or disadvantages with fortinet and this authentication thing, and the day to day effort needed to maintain this working fine.

Any feedback of your past experiences, and or recommendations, would be very appreciated.

Thanks in advance.