When FortiGate's LDAP authentication can't find any matching DN it reports "get all dn - found no DN," which usually means the user either isn't in the group(s) you've told FortiGate to check or the account isn't currently active.
Ensure the user is a member of at least one AD group.
If you've configured FortiGate to restrict logins to specific groups, any user not in one of those groups will simply never be found by the LDAP search.
Ensure the account is active.
FortiGate's default search filter excludes disabled or locked accounts, so a disabled user object will likewise never show up in the DN search.

The debug shows npu_flag=02 and dec_npu=1/1, meaning only the inbound (decrypt) IPsec SA has been offloaded to the NPU. Value 02 corresponds to inbound/offload, so the inbound SA was copied to hardware.

When you enable FSSO real time debug you'll see explicit socket errors if the FortiGate can't reach the collector's IP (e.g. timeout or "no route to host"), which tells you the agent isn't reachable. If the TCP port is wrong or the listener isn't running, you'll see "Connection refused" in the debug output, pinpointing a port mismatch. And if the configured pre shared secret doesn't match, the logs show an authentication failure or "invalid key" message, clearly indicating a password mismatch. These three conditions - unreachable IP, refused connection, and bad PSK - are all directly diagnosable via the real time debug.

The session has been offloaded.
The offload=8/8, ips_offload=1/1, and in_npu=1/1 out_npu=1/1flags show both the forwarding and IPS functions are being handled in hardware.
The traffic matches Policy ID 1.
The policy_id=1field indicates this session was created by firewall policy 1.