Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 5 replies
  • Answers 1 answer
  • Subscribers 41 subscribers
  • Views 4635 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cannot establish NTLM authentication channel with XXXX

Scott Doty

Greetings,


Please bear with me:

We are getting the above message in our FW logs. I have verified the following things thus far:

Users can login to the VPN and validate w/o issue and w/o the captive portal.

The FW logs show all user activity for login/logout.

AD SSO is enabled.

STAS was also being used, but in troubleshooting this I have turned it off. Same results and all users are working fine.

FQDN is being used for the AD servers and connection test passes

-------------------- What issue I still have -----------------

I am still getting the 'Cannot establish NTLM authentication channel with <domain> error in the authentication logs, despite it seemingly authenticating everyone that is logging into the VPN. STAS is disabled and only AD SSO is enabled. I've gone through a large part of the troubleshooting steps from this article:

doc.sophos.com/.../index.html

However when I get to the step /oss/klist -e -k /tmp/krb5.keytab I get a permission denied error. (Also, it's not /oss/klist, it is oss/klist  as oss is a subdir of nasm.

so I cannot go further in that test.

We are running 19.5.2 MR2-Build624, Model SG330

Any suggestions?



This thread was automatically locked due to age.
Parents
  • 0

    Do you need AD SSO NTLM at all? NTLM is used for web based authentication. If you use AD SSO via STAS you dont need it. So you could simply disable AD SSO from Device Access and not use it. 

    __________________________________________________________________________________________________________________

Reply
  • 0

    Do you need AD SSO NTLM at all? NTLM is used for web based authentication. If you use AD SSO via STAS you dont need it. So you could simply disable AD SSO from Device Access and not use it. 

    __________________________________________________________________________________________________________________

Children
  • 0 in reply to LuCar Toni

    Unfortunately we still have older servers in play so NTLM is still out there. Things are working well with the STAS turned off despite the above errors.  Is the AD SSO only used for the web based authentication, or does it also work for client authentication? It seems to be working w/o STAS which is why I ask.

Unfiltered HTML