Fortinet black logo

Administration Guide

FSSO using Syslog as source

FSSO using Syslog as source

This example describes how to configure Fortinet Single Sign-On (FSSO) agent on Windows using syslog as the source and a custom syslog matching rule.

The FSSO collector agent must be build 0291 or later, and in advanced mode (see How to switch FSSO operation mode from Standard Mode to Advanced Mode).

To configure the FSSO agent on Windows:
  1. Open the FSSO agent on Windows.

  2. Click Advanced Settings.

  3. Go to the Syslog Source List tab.

  4. Select Enable this feature.

  5. Set Syslog Listening Port, or use the default port.

  6. Click Manage Rule.

  7. Create a new syslog rule:

    1. Click Add.

    2. Configure the rule:

      Trigger

      722051

      Logon

      assigned to session

      Username Field

      User <{{:username}}>

      Client IPv4 Field

      IPv4 Address <{{:client_ip}}>

      Client IPv6 Field

      IPv6 Address <{{:client_ipv6}}>

      Group Field

      Group <{{:group}}>

      Groups List Separator

      ,

    3. To test the rule, enter a sample log line, then click Test.

    4. Click OK.

  8. Create a new syslog source:

    1. On the Advanced Settings window, click Add.

    2. Configure the source:

      Name

      VPN-Connection

      IP Address

      192.168.100.12

      Matching Rule

      VPN

      User Type

      External: Users are not defined on the CA and user groups come from the source.

      Remote User: Users are defined on a remote LDAP server and user groups are retrieved from the specified LDAP server. Any group from the syslog messages are ignored. See Connect to a remote LDAP server .

    3. Click OK.

  9. Click OK.

Connect to a remote LDAP server

This section describes how to connect to a remote LDAP server to match the user identity from the syslog server with an LDAP server.

To connect to a remote LDAP server:
  1. Open the FSSO agent on Windows.

  2. Click Advanced Settings.

  3. Go to the Syslog Source List tab.

  4. Click Manage LDAP Server.

  5. Click Add and configure the LDAP server settings:

  6. Click OK.

  7. Select the syslog source and click Edit.

  8. Set User Type to Remote User, and select the LDAP server from the drop-down list.

  9. Click OK.

FSSO using Syslog as source

This example describes how to configure Fortinet Single Sign-On (FSSO) agent on Windows using syslog as the source and a custom syslog matching rule.

The FSSO collector agent must be build 0291 or later, and in advanced mode (see How to switch FSSO operation mode from Standard Mode to Advanced Mode).

To configure the FSSO agent on Windows:
  1. Open the FSSO agent on Windows.

  2. Click Advanced Settings.

  3. Go to the Syslog Source List tab.

  4. Select Enable this feature.

  5. Set Syslog Listening Port, or use the default port.

  6. Click Manage Rule.

  7. Create a new syslog rule:

    1. Click Add.

    2. Configure the rule:

      Trigger

      722051

      Logon

      assigned to session

      Username Field

      User <{{:username}}>

      Client IPv4 Field

      IPv4 Address <{{:client_ip}}>

      Client IPv6 Field

      IPv6 Address <{{:client_ipv6}}>

      Group Field

      Group <{{:group}}>

      Groups List Separator

      ,

    3. To test the rule, enter a sample log line, then click Test.

    4. Click OK.

  8. Create a new syslog source:

    1. On the Advanced Settings window, click Add.

    2. Configure the source:

      Name

      VPN-Connection

      IP Address

      192.168.100.12

      Matching Rule

      VPN

      User Type

      External: Users are not defined on the CA and user groups come from the source.

      Remote User: Users are defined on a remote LDAP server and user groups are retrieved from the specified LDAP server. Any group from the syslog messages are ignored. See Connect to a remote LDAP server .

    3. Click OK.

  9. Click OK.

Connect to a remote LDAP server

This section describes how to connect to a remote LDAP server to match the user identity from the syslog server with an LDAP server.

To connect to a remote LDAP server:
  1. Open the FSSO agent on Windows.

  2. Click Advanced Settings.

  3. Go to the Syslog Source List tab.

  4. Click Manage LDAP Server.

  5. Click Add and configure the LDAP server settings:

  6. Click OK.

  7. Select the syslog source and click Edit.

  8. Set User Type to Remote User, and select the LDAP server from the drop-down list.

  9. Click OK.