Create Windows firewall rules to allow Fortigate FSSO Collector inbound communications.

Powershell_Fortinet_FSSO_Collector_inboutd_firewall_rules.ps1

<# 
https://community.fortinet.com/t5/FortiGate/Technical-Tip-List-of-TCP-and-UDP-ports-used-by-the-FSSO/ta-p/194130
UDP/8002 – DC Agent keepalive and push logon info to Collector Agent
TCP/8001 – FortiGate to FSSO Collector Agent connection (SSL)
TCP/8000 – FortiGate to FSSO Collector Agent connection
TCP/8000 – NTLM
#>

$fgtIP = '192.168.0.1'
$DCs = @('192.168.0.51', '192.168.0.52', '192.168.0.61', '192.168.0.62')

New-NetFirewallRule -Action Allow `
 -Description "Allow FortiGate to FSSO Collector Agent connection" `
 -Direction Inbound `
 -Enabled True `
 -Group Fortinet_SSO `
 -LocalPort 8000,8001 `
 -DisplayName Fortinet-Allow-FGT_to_SSO_Collector `
 -Protocol TCP `
 -RemoteAddress $fgtIP  `

 New-NetFirewallRule -Action Allow `
 -Description "DC Agent keepalive and push logon info to Collector Agent" `
 -Direction Inbound `
 -Enabled True `
 -Group Fortinet_SSO `
 -LocalPort 8002 `
 -DisplayName Fortinet-Allow-DCAgent_to_SSO_Collector `
 -Protocol UDP `
 -RemoteAddress $DCs