Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 30 replies
  • Subscribers 8 subscribers
  • Views 11819 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Safeguard

Dan Petford

Hi,

 

I have a number of Desktop PC's and Laptops that are at remote locations that don't require to be on our Domain as they are running Citrix.

 

We have been told to get them to work with Sophos Safeguard, we will need to import the certificate in the 'Personal' section of 'Certificates'.

 

The above has been tried with no success, can anyone help or suggest anything I am missing?

 

Kind regards, Dan Petford



This thread was automatically locked due to age.
Parents
  • 0

    Hi Dan - Although they're not on the domain, are you treating them like domained machines?

     

    Does your SafeGuard server have a secondary DMZ server, or is the primary server accessible to them (via public/VPN etc..)

     

    They can work with Sophos but they either have to have access to the server, or treated as standalone clients. With the standalone clients you can create a package configuration file to apply to the client that contains the policies, but the key backup location would have to be stored somewhere for the recovery of the device - ideally somewhere centrally and obviously not stuck on the client! 

  • 0 in reply to MichaelMcLannahan

    Yes, we do have a secondary server in dmz (well port forwarded actually, but same end result) – that’s what allows the remote domain-joined PC’s to sync with safeguard. Just to clarify that remote domain computers are fine, just the workgroup ones that won’t connect.

    I did find that the local machine required a password, so have set one, and it started to initialise, however it still doesn't connect to the server, and the status is a Guest now.

  • 0 in reply to MichaelMcLannahan

    We have tested a Laptop on the Domain, connected via 4G and SafeGuard still synchronises without our VPN client connected.

  • 0 in reply to Dan Petford

    I have now tested with a VPN and the synchronisation still fails.

  • 0 in reply to Dan Petford

    I still suspect DNS/routing here. If the DMZ is publically accessible it should be accessible to all clients - domained or not. 

    If you open a browser on the device and type in the address does it resolve the page? https://yourserver.yourpublicdomain.com/SGNSRV/trans.asmx 

  • 0 in reply to Dan Petford

    Well it's progress! :)

    Can you confirm you have BOTH primary and secondary p7b certs within c:\programdata\Ultimaco\SafeGuard Enterprise\LocalCache\transout\config.

    You can view them in Notepad and you should see your DNS resolved name in plain text in there (scroll to the right, it's about halfway in)

    Can you also check that this is the correct publically addressable name of the SSL cert too. 

    These are the locations of the certs placed there by the configuration tool MSI.

  • 0 in reply to MichaelMcLannahan

    I can confirm both Primary and Secondary certificates are present in the above location.

     

    For some reason the Secondary only shows the internal hostname, not sure if this is correct or not?

  • 0 in reply to Dan Petford

    No it's not correct and would explain why the client can't resolve the secondary DMZ server (Your primary is the internal server right?)

    I would check the configuration MSI again - it's possible to unzip it using 7Zip or similar and view the contents 

     

    The secondary cert must be in the publically resolvable external hostname, as that's how the client will resolve the server address.  It would explain too why the domain bound client would resolve this address/DFS too.

     

    Can you use the configuration tool again to produce a "new" client MSI, extract and read the contents and then check the secondary cert address again?

    If it's the internal address still this will need to be corrected. I would suspect that applying the server configuration again to the secondary server should resolve this?

  • 0 in reply to MichaelMcLannahan

    How do the domain clients sync, as they have the same secondary cert.

    It's very strange how a domain client that's not on our LAN or VPN is syncing?

  • 0 in reply to MichaelMcLannahan

    Hi Michael,

    Still having issues with the non-domain PC's, however also having the same issue with domain PC's.

    The PC in question is not appearing in the console, if I import I get the attached message.

  • 0 in reply to Dan Petford

    That's a nasty looking error! So are other PC's importing fine and it's just this PC, or none importing?

    It is possible to have clumsy duplicates in the console too - Have you verified this exact host doesn't exist already (or hasn't been renamed and the "old" version of it still exists?

    Are you logged in as MAINMSO when this is seen, or another user? If you haven't tried MAINMSO it may be worth trying that account to rule out perms?

Reply
  • 0 in reply to Dan Petford

    That's a nasty looking error! So are other PC's importing fine and it's just this PC, or none importing?

    It is possible to have clumsy duplicates in the console too - Have you verified this exact host doesn't exist already (or hasn't been renamed and the "old" version of it still exists?

    Are you logged in as MAINMSO when this is seen, or another user? If you haven't tried MAINMSO it may be worth trying that account to rule out perms?

Children
No Data
Unfiltered HTML