FSSO: agent vs agentless
Fortinet Single Sign-On · DC agent · collector agent · polling mode
how the FortiGate learns which user is behind an IP so identity-based policies work without a login prompt
The domain most NOC engineers are weakest on. FSSO maps IP → user → groups by watching AD logon events; policies then match on the group.
How it is read
DC agent mode
mode
A small agent on every domain controller catches logon events in real time and forwards them to a collector agent, which aggregates and feeds the FortiGate (TCP 8000). Fastest and most reliable; needs software on every DC.
Agentless / polling mode
mode
The collector agent (or the FortiGate itself, in agentless polling) polls DC security event logs on a timer (WinSecLog), or polls via WMI. No agent on the DCs, but slower to see logons, heavier on the DCs, and misses events if polling interval > logon churn. The FortiGate-direct agentless variant also has scale limits.