Sophos XG does not recognize user group returned by NPS RADIUS server

We also have the same problem with the current version SFOS 20.0.2 MR-2-Build378.

RADIUS authentication works without any problems - however, the group memberships are not transferred.

As a temporary workaround, we change the “default group” under Authentication > Services to a VPN-active group so that the users can at least establish a connection.

Hi all,

has this ever worked before?

Hello Dirk,

yes it is. I have configured it about two years ago. Then I realized that it is not working any more. Since second authentication server is local AD, my users were able to login and have most of access due to rules configuration. However, they are recognized as users coming from local AD and not from RADIUS. But I can still see some users last time logged in long time ago via RADIUS with group membership at the time of last login so I can confirm that it worked.

So, how SFOS works here in most deployments: You can add to the Radius Server the used Domain. 
When you do this, SFOS is merging the information from AD and Radius to one object. Meaning, you authenticate with a user called "test" via AD: It will generate test@domain.com as an UPN. 

If you authenticate via Radius this user test, SFOS will add the domain "domain.com" and merge both objects together.

Did you do this? See: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Authentication/Servers/RADIUS/AuthenticationRADIUSServerAdd/index.html 

Hello LuCar Toni,

I just explained how it happen that we did not realize that RADIUS authentication is not working for some longer time. In our setup RADIUS authentication is let's say main authentication method. We have recently restricted local AD authentication for just few users as a fall back mechanism. We are doing so since we want to increase security and force users to use O365 integrated MFA authentication in Sophos VPN client. So you may consider that local AD authentication does not exist. If I remove it and leave RADIUS only it will behaves as I have explained above. Regarding your question about RADIUS configuration it is correctly configured:

Domain name is correct and it is same as UPN for our O365 users.

Can confirm the same behavior. I configured it exactly as in your screenshot above, defined the Filter-Id in the RADIUS-Default Attributes of my Windows NPS Server. When I log in with my RADIUS user, it can authenticate successfully but the user is still in the default "guest group".

Does the user has other group memberships in the UI and do you have two different users (Radius and a AD user) ? 

Just for transparency: There is a ongoing situation with NPS and Radius: https://support.sophos.com/support/s/article/KBA-000009901?language=en_US 

My group "WLANVPN" that I use for RADIUS is created on the firewall and the RADIUS and the "Filter-Id" Attribute which I use for the group name attribute is set to "WLANVPN" too on the RADIUS server. The group is sorted over all groups in the sophos group order menu. The users are the same, so the user "marcel" on sophos firewall was authentificated successfully with RADIUS. So the auth works, but the group membership of "WLANVPN" is not transferred. In my shell access log I can see the same behavior like Haris.

 LuCar Toni  I have not problems with authenticating users with RADIUS. But with group assignment.

We have been having this same issue on v20.0.1 MR-1-Build342 since upgrading from an older v19 firmware. (Can't remember exactly what version of v19.) Our users are automatically put into the proper firewall group that was imported from Active Directory when they sign into the VPN portal, as that is the default sign-in method for the portal. However, when connecting via SSL VPN, which defaults to RADIUS, the user is always taken out of that group and placed into Open Group after authorization.

I am comparing this to another firewall running v19.0.0 GA-Build317, and that keeps the groups correctly when using RADIUS authentication.

The RADIUS server in the non-working deployment appears to be sending the right group name via Filter-Id.

Maybe anyone which setup is working? I tried it with "Filter-Id" in Standard RADIUS attributes with my group name inside (on NPS) Then I wrote "Filter-Id" and after a failure "<my groupname>" in die RADIUS group name attribute on XG but nothing works. The user stays in die Default group after logging in to the userportal. The group is created on XG and is sorted to the top. Anyone?!

The docs are not a help and after hours of Gooooogling I could not found anything.