|
|
|
Using FSAE on your network | Configuring FSAE on Windows AD |
FSAE sends information about Windows user logons to FortiGate units. If there are many users on your Windows AD domains, the large amount of information might affect the performance of the FortiGate units. To avoid this problem, you can configure the FSAE collector agent to send logon information only for groups named in the FortiGate unit’s firewall policies.
On each domain controller that runs a collector agent, you need to configure
•Windows AD user groups
•collector agent settings, including the domain controllers to be monitored
•the collector agent Global Ignore list
•the collector agent FortiGate Group Filter for each FortiGate unit
The following client/server operating systems can be used:
Server: Microsoft Windows 2000, Microsoft Windows 2003
Client: Microsoft Windows 2000 Professional, Microsoft Windows XP Professional
Configuring Windows AD server user groups
FortiGate units control access at the group level. All members of a group have the same network access as defined in FortiGate firewall policies. You can use existing Windows AD user groups for authentication to FortiGate units if you intend that all members within each group have the same network access privileges. Otherwise, you need to create new user groups for this purpose.
If you change a user’s group membership, the change does not take effect until the user logs off and then logs on again.
FSAE sends only Domain Local Security Group and Global Security Group information to FortiGate units. You cannot use Distribution group types for FortiGate access. No information is sent for empty groups.
Refer to Microsoft documentation for information about creating groups.
Configuring collector agent settings
You need to configure
•the Windows AD domain controllers to monitor
•the Windows AD users to ignore because they do not participate in firewall authentication on any FortiGate unit
•the Windows AD group information to send to each FortiGate unit
You can also alter default settings and settings you made during installation.
Fortinet Server Authentication Extension Version 1.5 Technical Note |
|
9 |