Heartbeat authentication failed : username without domain name maybe the cause- Live users disappear but still connected to vpn

Question

Hello, 
 we use the SSLVPN authentication to apply different rules for users and the heartbeat to have the synced security. 
 
 Sometimes the user still connected to the VPN but not visible in the live user, in this case the rules with match known user not work! He need to reconnect the vpn to be visible again. 
 
 I found on the log a lot of error in the authentication tab related to heartbeat. All heartbeat have the status FAILED. 
 
 If i compare with SSLVPN, the @domain is visible and the authentication work fine.

For the problematic user, we can see the logout in the log but on the desktop ,the vpn still connected ! 
 
 Any idea why the heartbeat doesn't return the domain? Could be the cause of my problem? Thank you

LuCar Toni · Accepted Answer

XG tries your username (SAMAccountname) and fires it against all AD server, you configured on XG. Seems like 3 different AD Server are configured. 
 It is important to notice the used domain on the XG in AD Servers. This will be attached and used against this AD server. Seems like this does not work. 
 Looking at SSLVPN, it looks like it uses a UPN (Accountname + domain + top level domain).

Julian Cast · Answer

I deleted a test user with @company.int and changed in authentication server for the specific ad in the field "domain name" i wrote @company.com and now i made a new connection using the portal and now the name is correct! I need other checks to verify if the authentication using heartbeat work...

LuCar Toni · Answer

Let me rephrase my point: 
 
 Endpoint extract the Username and the domain. 
 Sends it to XG. 
 XG looks up the matching domain in the list of AD Servers. 
 Sends AD user name to the matching AD Servers. 
 
 The used domain on the endpoint could be different to the domains on the XG.

emmosophos · Answer

Hello Julian, 
 Thank you for contacting the Sophos Community. 
 What do you see in the /log/access_log.log for this user? 
 For the SSL VPN you&rsquo;re using two different types of authentication? 
 As a suggestion, if you&rsquo;re using Heartbeat and STAS for authentication, try to stick to only one type of authentication for the same segment of devices. 
 Regards,

Heartbeat authentication failed : username without domain name maybe the cause- Live users disappear but still connected to vpn

Top Replies