4.2 Fortinet Single Sign-On (FSSO) Architecture & Modes

Fortinet Single Sign-On (FSSO) Architecture & Modes

Fortinet Single Sign-On (FSSO) is a passive user authentication technology in FortiOS 7.6 designed to deliver seamless, transparent access control for users operating in Microsoft Active Directory (AD) environments. Unlike active authentication—where users are explicitly prompted for credentials at a captive portal—FSSO automatically identifies users when they log onto domain-joined Windows workstations. FortiGate associates the workstation's source IP address with the user's AD identity and Active Directory group memberships, enforcing identity-based firewall rules transparently.

---

FSSO Core Architecture

An FSSO deployment consists of three primary components:

1. Windows Domain Controllers (DCs): Authenticate domain users and generate Windows Security Event logs.
2. FSSO Collector Agent: A Windows service application that gathers logon events, performs group filtering, verifies workstation presence, and maintains master logon tables.
3. FortiGate NGFW: Receives parsed IP-to-user maps from the Collector Agent or polls DCs directly, matching sessions against security policies.

[ Domain Controller ] --(Logon Event)--> [ Collector Agent ] --(TCP 8000)--> [ FortiGate ]

---

FSSO Deployment Modes

FortiOS 7.6 supports two architecture models: Agent-Based (Collector Agent) Mode and Agentless (Direct Polling) Mode.

1. Collector Agent Mode (Agent-Based)

In Agent-Based mode, the FSSO Collector Agent software is installed on a standalone Windows Server or a Domain Controller. The Collector Agent acts as a centralized middleware aggregator. Communication between the Collector Agent and FortiGate occurs over TCP port 8000 (or TCP port 8001 for SSL-encrypted connections).

Within Collector Agent mode, logon events are collected using two distinct methods:

A. DC Agent Mode (dcagent.dll)

• A dynamic link library (dcagent.dll) is registered inside the Windows Local Security Authority Subsystem Service (lsass.exe) on every Domain Controller.
• Whenever a user logs into the domain, dcagent.dll intercepts the authentication event in memory and immediately pushes a lightweight UDP packet to the Collector Agent on UDP port 8002.
• Advantages: Captures logons in real time, handles fast user switching, and prevents missed logon events during peak logon hours.

B. Collector Agent Polling Mode (WinSecLog)

• No software (dcagent.dll) is installed on the Domain Controllers.
• The Collector Agent periodically polls the Windows Security Event Log on each DC using Remote Procedure Call (RPC) or Windows Management Instrumentation (WMI) over TCP port 445 / 135.
• Advantages: Eliminates third-party software installation on DCs.
• Disadvantages: Can introduce logging latency and consume network bandwidth during event query sweeps.

2. Agentless (Direct Polling) Mode

In Agentless Mode, FortiGate directly polls Windows Domain Controllers without requiring any external Collector Agent software or Windows server installation.

• The FortiGate unit connects to DCs using SMB/WMI over TCP port 445 and reads Windows Security Event Viewer logs directly.
• FortiGate parses event logs in memory using its native fssoda daemon.
• Use Case: Recommended for smaller environments (fewer than 500 concurrent users and up to 5 DCs) where server installation is prohibited by strict change control policies.
• Drawbacks: Increases CPU and memory consumption on the FortiGate unit because the firewall must parse raw Windows event logs.

Event Logging, Group Filtering & Workstation Verification

Windows Security Event Logs & Protocols

When monitoring Domain Controllers, FSSO monitors specific Windows Event IDs:

• Event ID 4624: Successful User Account Logon.
• Event ID 4625: Failed User Account Logon (used to update fail counters).
• Event ID 4768: Kerberos Ticket Granting Ticket (TGT) Request.
• Event ID 4769: Kerberos Service Ticket (ST) Request.

NTLM vs Kerberos Authentication Handling

When users authenticate via NTLM, Windows Security Event 4624 explicitly records both the username and the source workstation IP address. In contrast, under pure Kerberos authentication, Event 4768 logs the user Kerberos principal name and client network address, but may format the IP address differently. The FSSO Collector Agent resolves hostnames to IP addresses via DNS reverse lookup when required.

---

FSSO Group Filtering Modes

Active Directory enterprise environments contain thousands of security groups. Transferring all AD groups to FortiGate creates unnecessary RAM overhead. FSSO implements Group Filtering to forward only security groups defined in active FortiGate firewall policies.

1. Standard Mode (NetBIOS):

   • Uses legacy Windows format: DOMAIN\\Group_Name.
   • Group matching is case-insensitive.
   • Does not support nested AD group hierarchies.

2. Advanced Mode (LDAP Distinguished Name):

   • Uses full LDAP Distinguished Name format: CN=Engineers,OU=IT,DC=corp,DC=local.
   • Supports nested AD groups (groups contained within groups).
   • Must be selected when deploying FSSO in enterprise organizations with multi-tier Organizational Units (OUs).

---

Workstation Verification & Dead-Entry Detection

Because users rarely perform formal domain logoffs when disconnecting laptops, FSSO must detect stale IP-to-user mappings to prevent IP spoofing or unauthorized access.

The Collector Agent uses two active Workstation Verification mechanisms:

1. ICMP Ping Sweep: Periodically pings client IP addresses. If a host stops responding, the session entry is marked suspicious.
2. WMI / Remote Registry Check: Connects to the client workstation over TCP port 445 / 135 to query the currently logged-on Windows user in the local registry (HKEY_USERS). If the user logged off or switched accounts, the Collector Agent updates FortiGate immediately.

---

FSSO Diagnostic CLI Commands & Troubleshooting

Troubleshooting FSSO requires verifying connections between FortiGate, Collector Agents, and Domain Controllers using CLI diagnostic tools.

1. View Active FSSO User Logon Sessions

To view all active IP-to-user mappings currently stored in FortiGate memory:

diagnose debug authd fsso list

Sample Output snippet:

----FSSO user list----
IP: 10.0.1.50  User: jdoe  Groups: CN=Domain Users,CN=Users,DC=corp,DC=local|CN=Engineers,OU=IT,DC=corp,DC=local  Workstation: WIN10-PC01  MemberOf: Engineers
Total FSSO sessions: 1

2. View Collector Agent Connection Summary

To check the health and connectivity status of configured Collector Agents:

diagnose debug authd fsso summary

3. Debug FSSO Agentless Polling Daemon (fssoda)

To monitor real-time polling logs when running in Agentless mode:

diagnose debug application fssoda -1
diagnose debug enable

4. Force FSSO Session Refresh

To force FortiGate to purge stale session entries and pull a fresh user list from Collector Agents:

execute fsso refresh

---

FSSO Deployment Mode Comparison

The following table summarizes key architectural differences across FSSO deployment modes: