Helpful ReplyHot!Fortigate FSSO user switch between LAN and WAN

Author
claumakurumure
Silver Member
  • Total Posts : 109
  • Scores: 5
  • Reward points: 0
  • Joined: 2009/06/03 06:33:15
  • Status: offline
2017/10/25 02:55:17 (permalink)
0

Fortigate FSSO user switch between LAN and WAN

Good day

The client is experiencing issues when switching between LAN and wireless via FSSO. Seems as if firewall is not refreshing/updating this correctly.
When user switches off wifi moving to lan ip address the fsso entry on the firewall is not updated. Still keeps original ip address received on the wifi network even when the wifi device is switched off

Please assist

Thank you
#1
xsilver_FTNT
Expert Member
  • Total Posts : 417
  • Scores: 87
  • Reward points: 0
  • Joined: 2015/02/02 03:22:58
  • Status: offline
Re: Fortigate FSSO user switch between LAN and WAN 2017/10/25 08:11:30 (permalink) ☄ Helpfulby fjulianom 2018/06/14 08:02:13
0
Hi,
issue might be caused by DNS which is not updated with proper IP when you switch networks.
By default MSFT DNS allows updates from DHCP but not clients and once DHCP assign new IP the A DNS record is overwritten by that IP.
If that is psotted by FSSO in new logon scenario, that IP is recorded.
If you then switch networks, no IP change happen and you are prohibited from access.
 
SOLUTIONS:
1. best slution IMHO, is to let DNS read and update A records from workstations, and therefore whenever NIC get IP assigned it will ADD (and not overwrite) an A record to the DNS zone. Result will be multiple A records and FSSO can handle upto 4. So your workstation can have upto 4 NICs with different subnets/IPs still registered in FSSO with same user.
 
2. IF you want to keep just one record and your DNS is getting overwritten properly whenever you change network and you are NOT connected to more than one at a same time, then you can use "verifyIP"=dword:00000000 registry key in HKEY_LOCAL_MACHINE\software\fortinet\fsae\collectoragent to make Collector Agent periodically checking DNS for changes. It will make additional DNS load and delay detection of the change till next check, so it's not instant change, but it will help you to realize that IP has changed while user was still logged on workstation.
 
3. worst solution is to logout and login again after network change as it will trigger new logon processing and new DNS querry.
 
Best regards,
Tomas

Kind Regards,
Tomas
#2
daac
Bronze Member
  • Total Posts : 25
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/06/05 13:27:22
  • Status: offline
Re: Fortigate FSSO user switch between LAN and WAN 2019/01/09 20:52:52 (permalink)
0
xsilver
Hi,
issue might be caused by DNS which is not updated with proper IP when you switch networks.
By default MSFT DNS allows updates from DHCP but not clients and once DHCP assign new IP the A DNS record is overwritten by that IP.
If that is psotted by FSSO in new logon scenario, that IP is recorded.
If you then switch networks, no IP change happen and you are prohibited from access.
 
SOLUTIONS:
1. best slution IMHO, is to let DNS read and update A records from workstations, and therefore whenever NIC get IP assigned it will ADD (and not overwrite) an A record to the DNS zone. Result will be multiple A records and FSSO can handle upto 4. So your workstation can have upto 4 NICs with different subnets/IPs still registered in FSSO with same user.
 
2. IF you want to keep just one record and your DNS is getting overwritten properly whenever you change network and you are NOT connected to more than one at a same time, then you can use "verifyIP"=dword:00000000 registry key in HKEY_LOCAL_MACHINE\software\fortinet\fsae\collectoragent to make Collector Agent periodically checking DNS for changes. It will make additional DNS load and delay detection of the change till next check, so it's not instant change, but it will help you to realize that IP has changed while user was still logged on workstation.
 
3. worst solution is to logout and login again after network change as it will trigger new logon processing and new DNS querry.
 
Best regards,
Tomas




Hello, you may indicate where I can find documentation on how this issue is handled on a timely basis (point 1), since I am seeing that the fsso overwrites the entries and is not creating a record with the other segment of the wireless.


Thank you
 
#3
xsilver_FTNT
Expert Member
  • Total Posts : 417
  • Scores: 87
  • Reward points: 0
  • Joined: 2015/02/02 03:22:58
  • Status: offline
Re: Fortigate FSSO user switch between LAN and WAN 2019/01/10 00:25:03 (permalink)
0
Hi,
my remarks are a bit outdated about MSFT stuff. On 2003 when I first seen this it was best to start from this MSFT tech doc .. 
https://docs.microsoft.co...2003/cc784052(v=ws.10)

Kind Regards,
Tomas
#4
Jump to:
© 2019 APG vNext Commercial Version 5.5