DSN (I think) issues

You created a DNS Request route for your internal domain? 

The clients asking XG as a DNS Server? 

XG´s forwarder is a DNS Service in the internet or your AD DNS Server?

Hi, thanks !

You created a DNS Request route for your internal domain? 

Yes - mydomain.net, target servers my 2 internal DNS servers. 

The clients asking XG as a DNS Server? 

No, clients asking internal DNS servers. Tried using XG as DNS server also - same result.

XG's forwarder is internet DNS service.

I do see this: Violation User_Identity in captured packet..

Port4 Port1 IPv4 UDP 50384,53

Violation
USER_IDENTITY

Not sure what to make of it? 

Do you use STAS or something like that? 

Do you use STAS or something like that? 

Yes, and now I tried to set Restrict client traffic during identity probe to No.

This made the violation disappear.. But still in windows log a get:

ID 5719

This computer was not able to set up a secure session with a domain controller in domain 

ID 129

NtpClient was unable to set a domain peer to use as a time source because of discovery error.

ID 1129

The processing of Group Policy failed because of lack of network connectivity to a domain controller.

Just 30 sek later:

ID 37

The time provider NtpClient is currently receiving valid time data from my domain controller

Hi Pete Hansen 

Please refer to the article for STAS - https://community.sophos.com/kb/en-us/125468

Thanks but still no luck.

Removed STAS config on XG and reinstalled SSO suite.

That might have fix almost all event log errors, except GPO not being applied at logon but these are being applied 2h later. I can live with that and maybe fix it :)

We are using both heartbeat and STAT auth - is that a problem?

Thanks again