STAS random disconnects live users - FW webfilter is blocking then

Hello,

You might wants to review below KBA:

community.sophos.com/.../sophos-firewall-best-practice-for-stas

Thanks for your answer.
I know this KBA but we didn't change anything tho, so that makes me wonder why this is happening.

Do you know what logon type 3 stays for?

Hello,

I understands that there is no change. But we still have to review the logs as per te troubleshooting steps added in KBA.

For logon type, refer below:

support.sophos.com/.../KBA-000006347

Thank you for your quick reponse.

Sure understand, do you know if I can see besides the stas logs on the agent itself is there a way to check the log of the firewall to understand why it might disconnect there from the live users list?

Also if logon type 3 means not DC server rather than a member server which is odd to me cause we only use the STAS agents on both of our DC Servers.

Thank you for your quick reponse.

Sure understand, do you know if I can see besides the stas logs on the agent itself is there a way to check the log of the firewall to understand why it might disconnect there from the live users list?

Also if logon type 3 means not DC server rather than a member server which is odd to me cause we only use the STAS agents on both of our DC Servers.

Hello,

Yes, you can review access_server.log file from advance shell. Add services in debug using below

#service access_server:debug -ds nosync   (use the same command to disable)

#tail -f /log/access_server.log

Also, kindly review the KBA for the recommended configuration when we have multiple AD.

Thanks, I will collect some data and try to analyze/identify the root cause of the problem.
Do you know why logon type 3 takes in place tho?

What do you mean with multiple AD? Do you mean multiple Domain Controller?

Hello,

Yeah I mean Domain Controller!

For logon type 3 as well, we need to investigate. You may review the stas.log file on DC.