Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 19 replies
  • Answers 1 answer
  • Subscribers 19 subscribers
  • Views 18204 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

User authentication against firewall from Terminalserver not working properly

LHerzog

Were having Windows TS with Intercept X. The TS is registered on the firewall (SFOS 19.5.1) as "Citrix Server".

The user that login to the TS are authenticating also against the firewall through the Intercept-X client on the TS. This is working generally.

But for a while now, we're getting complaints from changing users, saying they cannot access internet or internal servers. When checking, we see, their TS user session is not authenticated against the firewall.

We ask them to log off and log in again to the TS. Most of the times, this works after 2 or 3 attempts and their user session from the TS appears in the list of authenticated users on the firewall and they can proceed accessing internet and internal servers (based on FW rules with user authentication).

This is a strange behaviour and I'd like to know how we should proceed analyzing the issue.

Any idea?

TS has Endpoint EAP



This thread was automatically locked due to age.
Parents
  • 0

    You should check the logviewer of the firewall for authentication requests and the local server (sntp.log). 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    thank you. I put

    service access_server:debug -ds nosync

    and HB on the TS in debug.

    Need to wait now and hope the log on the firewall is not filling up the disk.

  • +1 in reply to LHerzog

    It looks like we have a development ticket opened for this issue as well. This is logged under the ID "WINEP-45479". This was identified just recently after a review from our L3 team. It seems the case was transferred to Endpoint support just after this was identified, as the development ticket is also with our Endpoint developers.

    Correction: The case was transferred to our network team so that information is available from both sides to progress the investigation.

    I will follow up with our support team to ensure the case is progressing smoothly.

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0 in reply to LHerzog

    to me it looks like the endpoint has issues recognizing the correct RDP session ID.

    In most cases I cannot find correct RDP Session ID of a user in the sntpservice log - it appears as an other ID. posted that already before.

    Today Support did the whole debug thing again in a remote session and updated me that they found that a login of a user is logged as logout.

    weird things going on.

    back again to the client team. just as mentioned here

  • 0 in reply to LHerzog

    Case is still open, currently at Dev to recreate issue on their side. I hope they do. On the other hand, we have a "working" life demo with the issue still ongoing....

    Today I noticed the opposite issue:

    A user that is no longer logged on a terminalserver, still has a Thin-Client session on the firewall.

  • 0 in reply to LHerzog

    You don't use STAS too for the same network?

    doc.sophos.com/.../index.html

    I had a similair strange issue with STAS tho. We used 2 different mailboxes (2 AD Accounts) sometimes STAS used the 2nd AD Account which didn't had the right perms for http access. So the use with his logged in AD Acc in Win10 got blocked due to the 2nd AD Acc Mailbox. Pretty weird too.

  • 0 in reply to LHerzog

    support case still going...
    a file ...netfilter/xt_LOG.ko has been replaced with a debug version to find out what's happening.
    I hope they do.

  • 0 in reply to LHerzog

    today on one of our TS it is only possible to authenticate one user. The user that comes second will not be authenticated.

    also a new experience. nothing logged in access_server.log when second user logs in.

    at logoff event of second user:


    MESSAGE   Aug 18 10:02:02.384832Z [access_server]: tlvserver_process_request: GOT ALERT.EXECUTE_HEARTBEAT
    ERROR     Aug 18 10:02:07.621513Z [access_server]: (_sqlite_db_handle_get_liveuserinfo): GET_LIVEUSER_INFO_TO_LOGOUT found no entries for IP xxx.xxx.xxx.xxx-3 (sqrs
    ERROR     Aug 18 10:02:07.621539Z [access_server]: (handle_external_logout_req_finish_free): SQLITE_REQ_GETLIVEUSERINFO query failed

    all parameters for SATC are correctly set on FW and TS.

    ntp logs on the client show the user logins and logoffs.

  • 0 in reply to LHerzog

    the case is still open. unbelievable, that it is not possible to catch the issue at Sophos side.

    2 versions of some debug files have been installed on the firewall since, we're on 19.5. MR3 and the reason why it is happening daily is still unidentified. TS user auth gets fordwarded to firewall, sometimes not.

    issue happening with and without EAP verision of enspoint.

  • 0 in reply to LHerzog

    documenting this Methusalem a little bit.

    last suggestion was:  add reg key on TS

    "HKLM\SOFTWARE\Sophos\Sophos Network Threat Protection\Application"  SatcPendDurationMs (DWORD)

    No specific value was given. So I tested with 2000ms but that made user logins on the TS extremely slow. So went to 1000ms. That should be enough in LAN environment anyway.

    This had absolutely no effect on the SATC Authentication on the Firewall on 2 TS I tested with. Still randomly users on the TS are not authenticated against the Firewall.

    even the 1000ms value slowed down user logins massively, less than the value with 2000ms though.

    Somehow it is hard to believe that this is working smoothly in production elsewhere.

Reply
  • 0 in reply to LHerzog

    documenting this Methusalem a little bit.

    last suggestion was:  add reg key on TS

    "HKLM\SOFTWARE\Sophos\Sophos Network Threat Protection\Application"  SatcPendDurationMs (DWORD)

    No specific value was given. So I tested with 2000ms but that made user logins on the TS extremely slow. So went to 1000ms. That should be enough in LAN environment anyway.

    This had absolutely no effect on the SATC Authentication on the Firewall on 2 TS I tested with. Still randomly users on the TS are not authenticated against the Firewall.

    even the 1000ms value slowed down user logins massively, less than the value with 2000ms though.

    Somehow it is hard to believe that this is working smoothly in production elsewhere.

Children
  • 0 in reply to LHerzog

    Update: in May 2023 (!) the case moved  from Endpoint Team to NSG, back to Endpoint and back again to NSG.

    Today I got an update from the case owner that it is now back at the Endpoint Team.

  • 0 in reply to LHerzog

    Hi, we have the same issue as LHerzogs describes.

    Since we change to XGS there is a lot of trouble all around authentification from am a terminal server session. support was already in, and one bug was fixed in one of the last firmeware updates.

    It is a shame for sophos. User based web filtering is a key feature, the only workaround is via direct proxy, what is not possible in our company.

    It get even worse as we were force from the standalone auth client to the new endpoint. both clients are sending the data package so it was no technical issue but a economic problem.

     please keep us up to date.

  • 0 in reply to Rouven Ott

    "good" to hear that we're not the only customer with this issue. Hope double debug analysis my lead someone to the root cause.

Unfiltered HTML