Which mode is recommended for FSSO deployments?
DC agent mode
Which naming conventions does the FSSO collector agent use to access the Windows AD in standard access mode?
- Windows convention-NetBios
- Domain\groups
Which FSSO mode requires more FortiGate system resources (CPU and RAM)?
Agentless polling mode
What are two servers that can be used with FSSO?
- AD
- Novell eDirectory
What are two polling modes used in FSSO?
- Collector agent-based
- Agentless
What are some things the collector agent is responsible for?
- Group verification
- Workstation checks
- Updates of login records on FortiGate
- Send security group and OU information to FortiGate
What is the most scalable agent mode in FSSO?
DC Agent Mode
What does the collector agent receive from the DC and forward to FortiGate?
- User name
- Host name
- IP address
- User group(s)
What are three methods for collector agent-based polling mode?
- WMI
- WinSecLog
- NetAPI
What is the recommended collector agent-based polling mode?
WMI
What is a drawback of using NetAPI as a polling mode?
It is faster, but can miss login events if DC has a heavy system load
What is a drawback of using WinSecLog as a polling mode?
It is the slowest mode, but it does see all login events
How does the collector agent get user login events?
Polls the DC frequently
What are some cons of using agentless polling mode?
- More CPU and RAM required by FortiGate
- Fewer available features
- FortiGate doesn’t poll workstation
Is DC agent mode or polling mode more complex?
- DC agent mode
- Multiple installations required (one per DC)
What are some pre-requisites that need to be properly configured on FortiGate so FSSO can work properly?
- DNS server must be able to resolve all workstation names
- Open TCP ports 445 and 139 so the collector agent can poll workstations
What does FortiGate use to query AD in agentless polling mode?
LDAP
Where would you configure LDAP to use with agentless polling mode?
Security Fabric > External Connectors
Where can you install a FSSO Agent?
Fortinet support website
What would you configure for a network service account when configuring FSSO, to avoid overwriting event logs?
Ignored User List
What’s the minimum bandwidth required for each domain controller for FSSO to function properly?
64 Kbps
