What Does the FSSO Collector Agent Do?
A company uses Fortinet Single Sign-On (FSSO) to authenticate users for firewall policies. The FSSO collector agent is installed on a Windows server and configured with Active Directory polling. What does the collector agent do?
Quick Answer
The answer is that the FSSO collector agent monitors Active Directory logon events and sends user-IP mappings to the FortiGate. This is correct because the collector agent acts as the intermediary between Active Directory and the FortiGate, using either NetAPI polling or security event log monitoring to capture user authentication events. It then compiles these into user-IP address mappings and transmits them to the FortiGate, enabling identity-based firewall policies without requiring users to re-authenticate. On the Fortinet NSE 4 Network Security Professional exam, this concept tests your understanding of how FSSO integrates with Windows environments to enforce user-aware security policies. A common trap is confusing the collector agent with the FortiAuthenticator or the FortiGate’s own polling—remember, the collector agent is a separate Windows service that does the heavy lifting of reading AD logs. For a quick memory tip: think of the collector agent as the “bridge” that turns a Windows login event into a firewall rule match.
⚠ Common exam trap
Candidates often confuse the collector agent's role with that of a RADIUS server or a direct authentication proxy, but FSSO is purely a passive monitoring mechanism that does not perform authentication itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It monitors AD logon events and sends user-IP mappings to the FortiGate
The FSSO collector agent polls Active Directory for security event logs to detect user logon events. It then maps the logged-on user to their IP address and sends this user-IP mapping to the FortiGate via the FSSO protocol (port 8000). This allows the FortiGate to enforce firewall policies based on user identity without requiring the user to authenticate directly to the FortiGate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It acts as a RADIUS proxy between FortiGate and AD
Why it's wrong here
That would be a different setup, not FSSO.
- ✓
It monitors AD logon events and sends user-IP mappings to the FortiGate
Why this is correct
This is the core function of the FSSO collector agent.
- ✗
It polls the FortiGate for user information
Why it's wrong here
The agent sends data to FortiGate, not the other way.
- ✗
It directly authenticates users to the FortiGate
Why it's wrong here
Authentication is done by AD; the agent only collects logon events.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate is configured with FSSO (Fortinet Single Sign-On) to authenticate users from Active Directory. Users are logging in to their domain-joined computers, but the FortiGate does not see the user sessions. The polling connector is configured correctly. What is the MOST likely reason?
medium- A.The FSSO agent is not installed on the Domain Controller
- B.The user group filter is too restrictive
- C.The FortiGate is not in the same subnet as the users
- ✓ D.DNS resolution for the Domain Controller is failing
Why D: The polling connector relies on the FortiGate communicating with the Domain Controller (DC) to retrieve user logon events. If DNS resolution for the DC fails, the FortiGate cannot resolve the DC's hostname to an IP address, preventing the polling connector from establishing the necessary LDAP or NetAPI connections to collect user session data. This is the most likely cause because the polling connector is configured correctly, but network-level name resolution is a prerequisite for any communication.
Variation 2. A FortiGate is configured with FSSO for firewall authentication. Users report they are prompted for credentials every time they access the internet, even though they are logged into the domain. What is the most likely cause?
medium- A.The users are not members of the FSSO group.
- B.The firewall policy uses 'All Users' instead of a specific group.
- ✓ C.The FSSO collector agent service is not running.
- D.The FortiGate's LDAP server is unreachable.
Why C: If the FSSO collector agent service is not running, the FortiGate cannot receive the logon events from the domain controllers. Without these events, the FortiGate has no way to know which users are authenticated, so it falls back to prompting for credentials on every new session, even though users are already logged into the domain.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.