Remote access setup.

Hi RJ,

Greetings.

You have an interesting requirement.

As per the requirement, User Portal is available by default.

You can access it on :- https://UTM's public IP(x.x.x.x)

If you want to authenticate Users through AD Server, you need to Sync AD Server with UTM,  you can find the below link to understand it further.

https://www.sophos.com/en-us/support/knowledgebase/123155.aspx

Remember that to import the Users  and sync to their respective groups in Firewall, these Users should be a member of secondary group in AD, as primary group membership won't be forwarded by AD to XG.

What is Captive Portal ?

Captive Portal authenticates users for Internet access. When users attempt to access the internet, a default Captive Portal is presented to authenticate the users. The default Captive Portal display can be customized in terms of organization name, logo, page - title, header, footer, background and font colours or links. Additionally, the default Captive Portal Settings can be changed as per the requirement.

Now, the functionality you are trying to achieve is technically known as HTML 5.

Before we suspect any wrong configurations, can you check if you have configured LAN_VPN Firewall rule (without MASQ) and VPN_LAN Firewall Rule (with MASQ).  if these Rules are in place, please provide us the screenshot of present configurations on XG.

Cheers

Sachin Gurung

Hi RJ,

Greetings.

You have an interesting requirement.

As per the requirement, User Portal is available by default.

You can access it on :- https://UTM's public IP(x.x.x.x)

If you want to authenticate Users through AD Server, you need to Sync AD Server with UTM,  you can find the below link to understand it further.

https://www.sophos.com/en-us/support/knowledgebase/123155.aspx

Remember that to import the Users  and sync to their respective groups in Firewall, these Users should be a member of secondary group in AD, as primary group membership won't be forwarded by AD to XG.

What is Captive Portal ?

Captive Portal authenticates users for Internet access. When users attempt to access the internet, a default Captive Portal is presented to authenticate the users. The default Captive Portal display can be customized in terms of organization name, logo, page - title, header, footer, background and font colours or links. Additionally, the default Captive Portal Settings can be changed as per the requirement.

Now, the functionality you are trying to achieve is technically known as HTML 5.

Before we suspect any wrong configurations, can you check if you have configured LAN_VPN Firewall rule (without MASQ) and VPN_LAN Firewall Rule (with MASQ).  if these Rules are in place, please provide us the screenshot of present configurations on XG.

Cheers

Sachin Gurung

Thank you very much for the reply.  Thanks to your link, i know have authentication working, the piece i missed was adding the new Authentication method under System > System Services > Authentication.   I have authentication and the bookmarks working as I think they should so I think the one piece left is adding the rules you mentioned.  Can you give me any more detail or is there a document detailing setup?  I'm guessing that the MASQ rule is for egress and should be (Internal Server IPs)->Any allow and the non MASQ rule is for ingress and should be Any->(server IPs) allow?

Or should those 2 rules be Server IPs to and from the AD VPN Users group I imported?

Hi RJ,

The ingress rule will be VPN_LAN (without MASQ). PFA Screenshot.

Next Rule will be LAN_VPN (with MASQ).

Let me know if you have any further questions.

Thank

Sachin Gurung

Sorry to be dense but in the second rule you say with MASQ but Masquerading is not switched to on in the screenshots.  Should that be on?

Hi RJ,

Thank you for correcting me :) 

I did the necessary changes.

Thanks

Sachin

Thank you, I think I have all the authentication working but I still have the same problem with the HTML5 RDP access.  I see the initial login screen for the RDP session but I cannot interact with it.  The mouse does not appear to work nor can I send the Ctrl-Alt-Del with the send Ctrl-Alt-Del option.

Any ideas?

Hi RJ,

Can you provide me screenshots ? This will help me know what is the exact matter.

Thank

Sachin

Ok, the issue appears to be a Chrome issue. It does work with Firefox and Edge.