An administrator configured a FortiGate to act as a collector for agentless polling mode. What must the administrator add to the FortiGate device to retrieve AD user group information?

In an agentless polling configuration, the FortiGate polls a Windows Domain Controller's event logs to learn about user logon events, which provides the username and IP address. However, to determine the user's group memberships for policy enforcement, the FortiGate must query the Active Directory (AD) database. This query is performed using the Lightweight Directory Access Protocol (LDAP). Therefore, an administrator must configure an LDAP server object on the FortiGate that points to the AD Domain Controller. This allows the FortiGate to retrieve group information associated with the authenticated user.

B. RADIUS server: RADIUS is a protocol for authentication, authorization, and accounting (AAA), not for directly querying an AD database for group memberships in an FSSO polling context. C. DHCP server: A DHCP server is responsible for assigning IP addresses to network devices and does not contain or provide AD user group information. D. Windows server: This option is too generic. While the AD service runs on a Windows Server, the specific service connector that FortiGate must configure to query for group information is LDAP. ---

1. FortiOS Administration Guide 7.0.0 | Page 1013, "LDAP" section: "You can configure FortiGate units to use an LDAP server to authenticate users and get user group information from an LDAP server." This establishes LDAP as the mechanism for retrieving group information.

2. FortiOS Administration Guide 7.0.0 | Page 1048, "Creating an FSSO user group" section: "When you create an FSSO user group, you add FSSO user groups from your Windows AD domain controller as members. The FortiGate must be configured with an LDAP server to be able to browse for Windows AD user groups." This directly links the FSSO mechanism (which includes agentless polling) to the requirement of a configured LDAP server for group retrieval.

3. Fortinet Cookbook | FortiOS 7.0, "FSSO polling mode for Windows AD" article, ID: FD36125: The configuration steps explicitly show creating an LDAP server connection to the Windows AD server (Step 2) and then using it to add remote AD groups to a FortiGate FSSO user group (Step 3). This demonstrates that LDAP is a mandatory component for integrating AD group information with FSSO polling.