Configuring the FSSO Collector agent for Windows AD
On the FortiGate unit, security policies control access to network resources based on user groups. With Fortinet Single Sign On, this is also true but each FortiGate user group is associated with one or more Windows AD user groups. This is how Windows AD user groups get authenticated in the FortiGate security policy.
Fortinet Single Sign On sends information about Windows user logons to FortiGate units. If there are many users on your Windows AD domains, the large amount of information might affect the performance of the FortiGate units.
To avoid this problem, you can configure the Fortinet Single Sign On Collector agent to send logon information only for groups named in the FortiGate unit’s security policies. See Configuring FortiGate group filters on page 574.
On each server with a Collector agent, you will be
- Configuring Windows AD server user groups
- Configuring Collector agent settings, including the domain controllers to be monitored
- Selecting Domain Controllers and working mode for monitoring
- Configuring Directory Access settings
- Configuring the Ignore User List
- Configuring FortiGate group filters for each FortiGate unit
- Configuring FSSO ports
- Configuring alternate user IP address tracking
- Viewing FSSO component status
Configuring Windows AD server user groups
FortiGate units control network resource access at the group level. All members of a user group have the same network access as defined in FortiGate security policies.
You can use existing Windows AD user groups for authentication to FortiGate units if you intend that all members within each group have the same network access privileges.
Otherwise, you need to create new user groups for this purpose.
If you change a user’s group membership, the change does not take effect until the user logs off and then logs on again.
The FSSO Agent sends only Domain Local Security Group and Global Security Group information to FortiGate units. You cannot use Distribution group types for FortiGate access. No information is sent for empty groups.
Refer to Microsoft documentation for information about creating and managing Windows AD user groups.
Configuring Collector agent settings
You need to configure which domain controllers the Collector agent will use and which domains to monitor for user logons. You can also alter default settings and settings you made during installation. These tasks are accomplished by configuring the FSSO Collector Agent, and selecting either Apply to enable the changes. At any time to refresh the FSSO Agent settings, select Apply.