Frequent logging out of users in Sophos XG Firewall

Question

Hi, 
 
 We have sophos XG 230 and getting following issues 
 Users are getting message like You were disconnected by the Administrator while using internet through captive portal or through authentication client after enabling match known users. 
 even though keep alive is selected in captive portal settings. 
 Even while working on internet it gets disconnected annoyingly. 
 
 following is the log. 
 INFO Jun 08 14:32:16 Plaintext password found in config file. Replaced with en INFO Jun 08 14:32:16 caa started in daemon mode with Process Id 27912! INFO Jun 08 14:32:16 Connecting to host 192.168.1.1 ... INFO Jun 08 14:32:17 Connected with AES256-SHA encryption. INFO Jun 08 14:32:17 Client type sent: Linux INFO Jun 08 14:32:17 Login was accepted. INFO Jun 08 14:32:17 PONG sent! INFO Jun 08 14:32:17 4 IPv4 addresses sent! INFO Jun 08 14:32:17 3 IPv6 addresses sent! INFO Jun 08 14:32:17 5 MAC addresses sent! INFO Jun 08 14:32:43 PING received. INFO Jun 08 14:32:43 PONG sent! INFO Jun 08 14:33:28 PING received. INFO Jun 08 14:33:28 PONG sent! INFO Jun 08 14:34:13 PING received. INFO Jun 08 14:34:13 PONG sent! WARN Jun 08 14:34:13 You were disconnected by the Administrator. INFO Jun 08 14:34:13 Sending SIGTERM to running caa with Process Id 27912. INFO Jun 08 14:34:13 Running instance of caa terminated by signal 15 INFO Jun 08 14:40:38 caa started in daemon mode with Process Id 29089! INFO Jun 08 14:40:38 Connecting to host 192.168.1.1 ... INFO Jun 08 14:40:39 Connected with AES256-SHA encryption. INFO Jun 08 14:40:39 Client type sent: Linux INFO Jun 08 14:40:39 Login was accepted. INFO Jun 08 14:40:39 PONG sent! INFO Jun 08 14:40:39 4 IPv4 addresses sent! INFO Jun 08 14:40:39 3 IPv6 addresses sent! INFO Jun 08 14:40:39 5 MAC addresses sent! INFO Jun 08 14:41:03 PING received. INFO Jun 08 14:41:03 PONG sent! INFO Jun 08 14:41:53 PING received. INFO Jun 08 14:41:53 PONG sent! INFO Jun 08 14:42:34 PING received. INFO Jun 08 14:42:34 PONG sent! INFO Jun 08 14:43:20 PING received. INFO Jun 08 14:43:20 PONG sent! INFO Jun 08 14:44:04 PING received. INFO Jun 08 14:44:04 PONG sent! INFO Jun 08 14:44:50 PING received. INFO Jun 08 14:44:50 PONG sent! INFO Jun 08 14:45:36 PING received. INFO Jun 08 14:45:36 PONG sent! INFO Jun 08 14:46:20 PING received. INFO Jun 08 14:46:20 PONG sent! INFO Jun 08 14:47:06 PING received. INFO Jun 08 14:47:06 PONG sent! INFO Jun 08 14:47:53 PING received. INFO Jun 08 14:47:53 PONG sent! INFO Jun 08 14:48:48 PING received. INFO Jun 08 14:48:48 PONG sent! INFO Jun 08 14:49:20 PING received. INFO Jun 08 14:49:20 PONG sent! INFO Jun 08 14:50:05 PING received. INFO Jun 08 14:50:05 PONG sent! INFO Jun 08 14:50:51 PING received. INFO Jun 08 14:50:51 PONG sent! INFO Jun 08 14:51:36 PING received. INFO Jun 08 14:51:36 PONG sent! INFO Jun 08 14:52:20 PING received. INFO Jun 08 14:52:20 PONG sent! INFO Jun 08 14:53:06 PING received. INFO Jun 08 14:53:06 PONG sent! INFO Jun 08 14:53:53 PING received. INFO Jun 08 14:53:53 PONG sent! INFO Jun 08 14:54:36 PING received. INFO Jun 08 14:54:36 PONG sent! INFO Jun 08 14:55:21 PING received. INFO Jun 08 14:55:21 PONG sent! INFO Jun 08 14:56:07 PING received. INFO Jun 08 14:56:07 PONG sent! INFO Jun 08 14:56:53 PING received. INFO Jun 08 14:56:53 PONG sent! INFO Jun 08 14:57:40 PING received. INFO Jun 08 14:57:40 PONG sent! INFO Jun 08 14:58:25 PING received. INFO Jun 08 14:58:25 PONG sent! INFO Jun 08 14:59:10 PING received. INFO Jun 08 14:59:10 PONG sent! INFO Jun 08 14:59:57 PING received. INFO Jun 08 14:59:57 PONG sent! INFO Jun 08 15:00:43 PING received. INFO Jun 08 15:00:43 PONG sent! INFO Jun 08 15:01:29 PING received. INFO Jun 08 15:01:29 PONG sent! INFO Jun 08 15:02:14 PING received. INFO Jun 08 15:02:14 PONG sent! INFO Jun 08 15:02:59 PING received. INFO Jun 08 15:02:59 PONG sent! INFO Jun 08 15:03:44 PING received. INFO Jun 08 15:03:44 PONG sent! INFO Jun 08 15:04:29 PING received. INFO Jun 08 15:04:29 PONG sent! INFO Jun 08 15:05:15 PING received. INFO Jun 08 15:05:15 PONG sent! INFO Jun 08 15:06:00 PING received. INFO Jun 08 15:06:00 PONG sent! INFO Jun 08 15:06:44 PING received. INFO Jun 08 15:06:44 PONG sent! INFO Jun 08 15:07:29 PING received. INFO Jun 08 15:07:29 PONG sent! INFO Jun 08 15:08:15 PING received. INFO Jun 08 15:08:15 PONG sent! INFO Jun 08 15:08:59 PING received. INFO Jun 08 15:08:59 PONG sent! INFO Jun 08 15:09:44 PING received. INFO Jun 08 15:09:44 PONG sent! INFO Jun 08 15:10:29 PING received. INFO Jun 08 15:10:29 PONG sent! INFO Jun 08 15:11:17 PING received. INFO Jun 08 15:11:17 PONG sent! INFO Jun 08 15:12:02 PING received. INFO Jun 08 15:12:02 PONG sent! INFO Jun 08 15:12:48 PING received. INFO Jun 08 15:12:48 PONG sent! INFO Jun 08 15:13:33 PING received. INFO Jun 08 15:13:33 PONG sent! INFO Jun 08 15:14:18 PING received. INFO Jun 08 15:14:18 PONG sent! INFO Jun 08 15:15:03 PING received. INFO Jun 08 15:15:03 PONG sent! INFO Jun 08 15:15:48 PING received. INFO Jun 08 15:15:48 PONG sent! INFO Jun 08 15:16:34 PING received. INFO Jun 08 15:16:34 PONG sent! INFO Jun 08 15:17:19 PING received. INFO Jun 08 15:17:19 PONG sent! INFO Jun 08 15:18:05 PING received. INFO Jun 08 15:18:05 PONG sent! INFO Jun 08 15:18:50 PING received. INFO Jun 08 15:18:50 PONG sent! INFO Jun 08 15:19:35 PING received. INFO Jun 08 15:19:35 PONG sent! INFO Jun 08 15:20:20 PING received. INFO Jun 08 15:20:20 PONG sent! INFO Jun 08 15:21:06 PING received. INFO Jun 08 15:21:06 PONG sent! INFO Jun 08 15:21:53 PING received. INFO Jun 08 15:21:53 PONG sent! INFO Jun 08 15:22:36 PING received. INFO Jun 08 15:22:36 PONG sent! INFO Jun 08 15:23:23 PING received. INFO Jun 08 15:23:23 PONG sent! INFO Jun 08 15:24:08 PING received. INFO Jun 08 15:24:08 PONG sent! INFO Jun 08 15:24:55 PING received. INFO Jun 08 15:24:55 PONG sent! INFO Jun 08 15:25:39 PING received. INFO Jun 08 15:25:39 PONG sent! INFO Jun 08 15:26:24 PING received. INFO Jun 08 15:26:24 PONG sent! INFO Jun 08 15:27:09 PING received. INFO Jun 08 15:27:09 PONG sent! INFO Jun 08 15:27:54 PING received. INFO Jun 08 15:27:54 PONG sent! INFO Jun 08 15:28:39 PING received. INFO Jun 08 15:28:39 PONG sent! INFO Jun 08 15:29:24 PING received. INFO Jun 08 15:29:24 PONG sent! INFO Jun 08 15:30:11 PING received. INFO Jun 08 15:30:11 PONG sent! INFO Jun 08 15:30:56 PING received. INFO Jun 08 15:30:56 PONG sent! INFO Jun 08 15:31:40 PING received. INFO Jun 08 15:31:40 PONG sent! INFO Jun 08 15:32:26 PING received. INFO Jun 08 15:32:26 PONG sent! INFO Jun 08 15:33:11 PING received. INFO Jun 08 15:33:11 PONG sent! INFO Jun 08 15:33:56 PING received. INFO Jun 08 15:33:56 PONG sent! INFO Jun 08 15:34:42 PING received. INFO Jun 08 15:34:42 PONG sent! INFO Jun 08 15:35:28 PING received. INFO Jun 08 15:35:28 PONG sent! INFO Jun 08 15:36:12 PING received. INFO Jun 08 15:36:12 PONG sent! INFO Jun 08 15:36:58 PING received. INFO Jun 08 15:36:58 PONG sent! INFO Jun 08 15:37:42 PING received. INFO Jun 08 15:37:42 PONG sent! INFO Jun 08 15:38:27 PING received. INFO Jun 08 15:38:27 PONG sent! INFO Jun 08 15:39:13 PING received. INFO Jun 08 15:39:13 PONG sent! INFO Jun 08 15:39:59 PING received. INFO Jun 08 15:39:59 PONG sent! INFO Jun 08 15:40:44 PING received. INFO Jun 08 15:40:44 PONG sent! WARN Jun 08 15:40:44 Session has timed out, please log in again. INFO Jun 08 15:40:44 Sending SIGTERM to running caa with Process Id 29089. INFO Jun 08 15:40:44 Running instance of caa terminated by signal 15 INFO Jun 08 16:20:29 caa started in daemon mode with Process Id 3458! INFO Jun 08 16:20:29 Connecting to host 192.168.1.1 ... INFO Jun 08 16:20:29 Connected with AES256-SHA encryption. INFO Jun 08 16:20:29 Client type sent: Linux INFO Jun 08 16:20:29 Login was accepted. INFO Jun 08 16:20:29 PONG sent! INFO Jun 08 16:20:29 4 IPv4 addresses sent! INFO Jun 08 16:20:29 3 IPv6 addresses sent! INFO Jun 08 16:20:29 5 MAC addresses sent! INFO Jun 08 16:20:38 PING received. INFO Jun 08 16:20:38 PONG sent! INFO Jun 08 16:21:23 PING received. INFO Jun 08 16:21:23 PONG sent! INFO Jun 08 16:22:10 PING received. INFO Jun 08 16:22:10 PONG sent! INFO Jun 08 16:22:54 PING received. INFO Jun 08 16:22:54 PONG sent! INFO Jun 08 16:23:39 PING received. INFO Jun 08 16:23:39 PONG sent! INFO Jun 08 16:24:25 PING received. INFO Jun 08 16:24:25 PONG sent! INFO Jun 08 16:25:09 PING received. INFO Jun 08 16:25:09 PONG sent! INFO Jun 08 16:25:54 PING received. INFO Jun 08 16:25:54 PONG sent! INFO Jun 08 16:26:39 PING received. INFO Jun 08 16:26:39 PONG sent! INFO Jun 08 16:27:24 PING received. INFO Jun 08 16:27:24 PONG sent! INFO Jun 08 16:28:12 PING received. INFO Jun 08 16:28:12 PONG sent! INFO Jun 08 16:28:56 PING received. INFO Jun 08 16:28:56 PONG sent! INFO Jun 08 16:29:41 PING received. INFO Jun 08 16:29:41 PONG sent! INFO Jun 08 16:30:29 PING received. INFO Jun 08 16:30:29 PONG sent! INFO Jun 08 16:31:14 PING received. INFO Jun 08 16:31:14 PONG sent! INFO Jun 08 16:31:59 PING received. INFO Jun 08 16:31:59 PONG sent! INFO Jun 08 16:32:44 PING received. INFO Jun 08 16:32:44 PONG sent! INFO Jun 08 16:33:30 PING received. INFO Jun 08 16:33:30 PONG sent! INFO Jun 08 16:34:14 PING received. INFO Jun 08 16:34:14 PONG sent! INFO Jun 08 16:34:59 PING received. INFO Jun 08 16:34:59 PONG sent! INFO Jun 08 16:35:45 PING received. INFO Jun 08 16:35:45 PONG sent! INFO Jun 08 16:36:29 PING received. INFO Jun 08 16:36:29 PONG sent! INFO Jun 08 16:37:14 PING received. INFO Jun 08 16:37:14 PONG sent! INFO Jun 08 16:38:00 PING received. INFO Jun 08 16:38:00 PONG sent! INFO Jun 08 16:38:44 PING received. INFO Jun 08 16:38:44 PONG sent! INFO Jun 08 16:39:29 PING received. INFO Jun 08 16:39:29 PONG sent! INFO Jun 08 16:40:14 PING received. INFO Jun 08 16:40:14 PONG sent! INFO Jun 08 16:40:59 PING received. INFO Jun 08 16:40:59 PONG sent! INFO Jun 08 16:41:44 PING received. INFO Jun 08 16:41:44 PONG sent! INFO Jun 08 16:42:32 PING received. INFO Jun 08 16:42:32 PONG sent! INFO Jun 08 16:43:17 PING received. INFO Jun 08 16:43:17 PONG sent! INFO Jun 08 16:44:01 PING received. INFO Jun 08 16:44:01 PONG sent! INFO Jun 08 16:44:46 PING received. INFO Jun 08 16:44:46 PONG sent! INFO Jun 08 16:45:32 PING received. INFO Jun 08 16:45:32 PONG sent! INFO Jun 08 16:46:17 PING received. INFO Jun 08 16:46:17 PONG sent! INFO Jun 08 16:47:02 PING received. INFO Jun 08 16:47:02 PONG sent! INFO Jun 08 16:47:48 PING received. INFO Jun 08 16:47:48 PONG sent! INFO Jun 08 16:48:32 PING received. INFO Jun 08 16:48:32 PONG sent! INFO Jun 08 16:49:18 PING received. INFO Jun 08 16:49:18 PONG sent! INFO Jun 08 16:50:03 PING received. INFO Jun 08 16:50:03 PONG sent! INFO Jun 08 16:50:51 PING received. INFO Jun 08 16:50:51 PONG sent! INFO Jun 08 16:51:37 PING received. INFO Jun 08 16:51:37 PONG sent! INFO Jun 08 16:52:23 PING received. INFO Jun 08 16:52:23 PONG sent! INFO Jun 08 16:53:07 PING received. INFO Jun 08 16:53:07 PONG sent! INFO Jun 08 16:53:53 PING received. INFO Jun 08 16:53:53 PONG sent! INFO Jun 08 16:54:37 PING received. INFO Jun 08 16:54:37 PONG sent! INFO Jun 08 16:55:24 PING received. INFO Jun 08 16:55:24 PONG sent! INFO Jun 08 16:56:09 PING received. INFO Jun 08 16:56:09 PONG sent! INFO Jun 08 16:56:54 PING received. INFO Jun 08 16:56:54 PONG sent! INFO Jun 08 16:57:40 PING received. INFO Jun 08 16:57:40 PONG sent! INFO Jun 08 16:58:25 PING received. INFO Jun 08 16:58:25 PONG sent! INFO Jun 08 16:59:10 PING received. INFO Jun 08 16:59:10 PONG sent! INFO Jun 08 16:59:55 PING received. INFO Jun 08 16:59:55 PONG sent! INFO Jun 08 17:00:40 PING received. INFO Jun 08 17:00:40 PONG sent! INFO Jun 08 17:01:25 PING received. INFO Jun 08 17:01:25 PONG sent! INFO Jun 08 17:02:12 PING received. INFO Jun 08 17:02:12 PONG sent! INFO Jun 08 17:02:56 PING received. INFO Jun 08 17:02:56 PONG sent! INFO Jun 08 17:03:41 PING received. INFO Jun 08 17:03:41 PONG sent! INFO Jun 08 17:04:27 PING received. INFO Jun 08 17:04:27 PONG sent! INFO Jun 08 17:05:11 PING received. INFO Jun 08 17:05:11 PONG sent! INFO Jun 08 17:05:56 PING received. INFO Jun 08 17:05:56 PONG sent! INFO Jun 08 17:06:42 PING received. INFO Jun 08 17:06:42 PONG sent! INFO Jun 08 17:07:26 PING received. INFO Jun 08 17:07:26 PONG sent! INFO Jun 08 17:08:12 PING received. INFO Jun 08 17:08:12 PONG sent! INFO Jun 08 17:08:57 PING received. INFO Jun 08 17:08:57 PONG sent! INFO Jun 08 17:09:42 PING received. INFO Jun 08 17:09:42 PONG sent! INFO Jun 08 17:10:28 PING received. INFO Jun 08 17:10:28 PONG sent! INFO Jun 08 17:11:13 PING received. INFO Jun 08 17:11:13 PONG sent! INFO Jun 08 17:11:59 PING received. INFO Jun 08 17:11:59 PONG sent! INFO Jun 08 17:12:45 PING received. INFO Jun 08 17:12:45 PONG sent! INFO Jun 08 17:13:31 PING received. INFO Jun 08 17:13:31 PONG sent! INFO Jun 08 17:14:16 PING received. INFO Jun 08 17:14:16 PONG sent! INFO Jun 08 17:15:00 PING received. INFO Jun 08 17:15:00 PONG sent! INFO Jun 08 17:15:46 PING received. INFO Jun 08 17:15:46 PONG sent! INFO Jun 08 17:16:30 PING received. INFO Jun 08 17:16:30 PONG sent! INFO Jun 08 17:17:15 PING received. INFO Jun 08 17:17:15 PONG sent! INFO Jun 08 17:18:01 PING received. INFO Jun 08 17:18:01 PONG sent! INFO Jun 08 17:18:46 PING received. INFO Jun 08 17:18:46 PONG sent! INFO Jun 08 17:19:31 PING received. INFO Jun 08 17:19:31 PONG sent! INFO Jun 08 17:20:16 PING received. INFO Jun 08 17:20:16 PONG sent! INFO Jun 08 17:21:01 PING received. INFO Jun 08 17:21:01 PONG sent! WARN Jun 08 17:21:01 You were disconnected by the Administrator. INFO Jun 08 17:21:01 Sending SIGTERM to running caa with Process Id 3458. INFO Jun 08 17:21:01 Running instance of caa terminated by signal 15 INFO Jun 08 17:46:18 caa started in daemon mode with Process Id 14018! INFO Jun 08 17:46:18 Connecting to host 192.168.1.1 ... WARN Jun 08 17:46:22 Could not connect to host 192.168.1.1! INFO Jun 08 17:46:32 Connecting to host 192.168.1.1 ... WARN Jun 08 17:46:36 Could not connect to host 192.168.1.1! INFO Jun 08 17:46:46 Connecting to host 192.168.1.1 ... WARN Jun 08 17:46:50 Could not connect to host 192.168.1.1! ERROR Jun 08 17:47:00 Could not establish secure connection after 3 tries. INFO Jun 08 17:47:00 Sending SIGTERM to running caa with Process Id 14018. INFO Jun 08 17:47:00 Running instance of caa terminated by signal 15 
 
 Regards, 
 Ashish

Aditya Patel · Answer

Hello Asish,

Could you check the following, Number of simultaneous logins on that user profile, This may occur if the same credentails were used on multiple system with a login limit set.

Also , please check the logs under using ssh > Option 5>3

#service access_server:debug -ds nosync <Enable Debug>

#tail -f /log/access_server.log <Check authentication logs>

#service access_server:debug -ds nosync <Disable Debug>

It is possible that the system went to sleep and the PING request was not sent by the system within 45 seconds . i.e 3 attempts and would disconnect automatically.

Regards,

Aditya Patel
Global Escalation Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'This helped me' link.