FSSO — how the firewall knows who is who in AD

A firewall thinks in IP addresses, but security policy is written in terms of AD users and groups: "accounting may, others may not". FSSO (Fortinet Single Sign-On) lets FortiGate learn which user sits behind which IP and apply policy by AD group.

Related topics in this course

• Event ID 4624 — the same logon event the Collector Agent builds the mapping from (Event ID reference).
• BloodHound — HasSession answers the same question: who is logged on where (/course/tools/bloodhound-walkthrough).
• Tiering — group based policy is how you enforce tier separation at the network level too.

How it works

• The user logs into the domain — a normal Kerberos logon, nothing new on the client.
• A Collector Agent on the DC (or a dedicated server) reads the security log and sees logon event 4624.
• The agent maps the user to the workstation IP and pushes that map to FortiGate (TCP, port 8000 by default).
• FortiGate applies policy by group: CN=Teachers → allow rule, CN=Students → deny rule.

Two operating modes

• Event Log / Polling mode — a Collector Agent on a dedicated server polls the DC for logon events.
• Kerberos-based FSSO — a light agent on every DC watches Kerberos authentication; scales better.
• There is also RADIUS Accounting based FSSO (for Wi-Fi) — same concept, a different source for the map.

Lab practice

• Install the Collector Agent on a Windows server in the corp.local lab domain. Create service account svc-fsso with a non-expiring password and only Event Log Readers rights — never Domain Admin.
• In the Collector Agent set the DC, the FortiGate connection password and the port (8000 by default).

config user fsso-agent
    edit "FSSO-CA"
        set server "10.0.0.10"
        set password <password-from-collector-agent>
    next
end

Now bind a FortiGate group to an AD group:

config user group
    edit "FSSO-Teachers"
        set member "FSSO-CA"
        config match
            edit 0
                set server-name "FSSO-CA"
                set group-name "CN=Teachers,OU=Groups,DC=corp,DC=local"
            next
        end
    next
end

Then use the group in a policy (Policy & Objects → Firewall Policy → Source: FSSO-Teachers). Verify: from a workstation signed in as a Teachers member open a site — the session should appear under Security Fabric → User & Device → FSSO.

Risks and detection

• The Collector Agent account: compromise means log access and influence over the map. Minimal rights, monitor 4624 events for that account.
• Agent-to-FortiGate traffic is not a VPN — use an isolated management segment. This is Tier 0 communication.
• Stale mappings: a workstation shut down improperly leaves the user-to-IP pair alive until timeout. Account for this in sensitive rules.

Mitigation

• A dedicated management VLAN between FortiGate and the Collector Agent.
• Agent account: Event Log Readers plus Deny interactive logon.
• Regular audit: compare active FSSO sessions with real logons (quser / whoami on suspicious hosts).
• Sensitive rules (Tier 1 server access) — match not only the FSSO group but also the segment IP range.