In an FSSO environment, a user is listed as active on FortiGate but cannot browse the internet. Which factor do you not need to verify as a potential problem?

Question

Options

• AThe connectivity between the collector agent and FortiGate
• BWhether there is a valid firewall policy
• CThe user's group information
• DThat the user's IP address is in the list of active FSSO users

• A
  83% (24)
• B
  3% (1)
• C
  3% (1)
• D
  10% (3)

Explanation

Since the user is already listed as active on FortiGate, the collector agent has already successfully delivered the authentication data - meaning connectivity between the collector agent and FortiGate is confirmed working by definition. Investigating that link would be redundant, making A the non-factor.

The distractors are all valid things to check:

• B (firewall policy): FSSO only handles identity; a matching, valid policy must still exist to permit the user's group to access the internet.
• C (group information): The user may be authenticated but assigned to the wrong group, or their group may not be mapped to a policy that allows browsing.
• D (IP address in active list): Even if the user appears active, you must confirm FortiGate has the correct IP tied to that user - stale or mismatched IP entries will cause policy lookups to fail.

Memory tip: Think of it as a pipeline - Collector → FortiGate → Policy → Internet. If the user shows up on FortiGate, the first pipe is already proven. Your troubleshooting starts at the second pipe onward: correct group, valid policy, and accurate IP mapping.

No community discussion yet for this question.