Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

STAS random disconnects live users - FW webfilter is blocking then

Hello Sophos Community,

first of all everything worked with STAS the last months without any problems.This week starting from monday on we are experiencing random disconnects on our STAS backend (it seems).
It hits several live users randomly.
They also seems to reconnect sometimes.
Or the use needs to sign out and sign in into their windows profile.

If the users gets kicked out then the webfilter of the fw is blocking their browsing through the WWW fully.

We are using 2 STAS Agents on both of our Domain Controller.
The XGS 4500 in (SFOS 20.0.2 MR-2-Build378) (in HA) is the STA collector.


What could it be?
How can I troubleshoot it?
If I do the WMI polling tester in STAS it works with all the clients (workstation, notebooks etc.)

What could cause them to loose the live auth.connection to the firewall.

Note:
We don't use the firewall option disconnect the user if the user is on idle for too long.


Both DCs are Windows Server 2016 with the version 14393.7259

Thanks for your help



Added TAGs
[edited by: Raphael Alganes at 10:25 AM (GMT -7) on 29 Aug 2024]
Parents Reply
  • Thank you for your quick reponse.

    Sure understand, do you know if I can see besides the stas logs on the agent itself is there a way to check the log of the firewall to understand why it might disconnect there from the live users list?

    Also if logon type 3 means not DC server rather than a member server which is odd to me cause we only use the STAS agents on both of our DC Servers.

Children