Synchronization between Active Directory Users and Groups

Hi Can carmack 

For User and Group behavior, I have shared the documents, please refer to them that How Sophos XG manage groups and related users as compare to AD.

Users are required when you want some restrictions based on the user such as Content filtering, Authentication, Reports, and such other requirements.

IPS policy can be directly applied to the firewall rules as per your requirement. You do not require to have users to use IPS policy, It's up to your requirement and network configuration

For IPS

https://docs.sophos.com/nsg/sophos-firewall/v16058/Help/en-us/webhelp/onlinehelp/index.html#page/onlinehelp/IpsPolicyManage.html

https://community.sophos.com/kb/en-us/124015

Thanks for reply.

After STAS integration duplicate users appeared in the firewall system.

Whatd be your advice for this users?

Hi Can carmack 

Is there any other authentication mechanism you are using other than STAS?

Could you please share the screenshots?

Hi Keyur 

No, just disabled STAS and uninstalled from server too.

Im confused about duplicate users after STAS try out.

In auth menu im using;

Servers > AD server
Services > Firewall auth methods; just local selected.
Clientless Users (Clientless Open Group) > 20+ defined

Thats all for auth.
What is the best method for users creation, manual or ad synch or?

Thanks bunch

Hi Can carmack 

Please go through the KBAs that have been given as based on this reply, you have not set the AD integration correctly.

Duplicate users are generally created if you have a misconfiguration.

On the XG there is a setting for STAS.  If you have more than 1 DC and you have assigned the DCs to each collector group, this will cause duplicate users.

Read the following articles completely:

https://community.sophos.com/kb/en-us/133531

https://community.sophos.com/kb/en-us/123156

https://community.sophos.com/kb/en-us/123154

https://community.sophos.com/kb/en-us/123023

https://community.sophos.com/kb/en-us/124848

https://community.sophos.com/kb/en-us/123029

Thanks!

Thank you for detailed answer.

Is this tool solve the user-ip match issues

Client Authentication Agent

I can only see users who this agent installed and clientless users are properly reported.

Id like to create reports paired with users .
But now just ip numbers appear in the reports.

If i install this agent to users what happens?

Dhcp Statics List

No User name in Logs Screen

Is this tool enough for keeping user activity in logs and reports?

Rather than AD integration?