This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SF Authentication behavior after STAS

Dear All,

we have managed to install STAS Suite on our AD and now the Sophos XG Firewall is importing users from AD (not seeing all of them). there are some things i would like to ask:

1- how the SF populates the "User" section of firewall by communicating with AD. does it imports all the users at once or upon user logon ?

2- if we have multiple child domains in our environment, shall we have to install STAS suite on other DCs as well to import their users ?

3- now that i have installed STAS suite in AD, i am still seeing captive portal screen while opening the browser. after logon i can proceed with browsing. shall it suppose to work like that ?

4- how can i verify from SF if the STAS suite is working fine.

we followed this article to install STAS :

https://www.sophos.com/en-us/support/knowledgebase/123156.aspx

kindly guide me. Sophos XG is installed in "Gateway" mode.

Regards,

Faheem

This thread was automatically locked due to age.

0 lferrara over 8 years ago

Faheem,

did you follow the entire article? inside the KB you will find another KB:

https://www.sophos.com/en-us/support/knowledgebase/123155.aspx and then https://www.sophos.com/en-us/support/knowledgebase/123158.aspx

You should install STAS on every domain that you want to manage. Install it at least on 2 DC for failover. https://www.sophos.com/en-us/support/knowledgebase/123154.aspx

So when you create the Policy rule, inside the Match Users you are able to select the imported groups/users and the captive portal will not appear anymore.
Cancel
Vote Up 0 Vote Down

Cancel
0 FaheemSarwar over 8 years ago in reply to lferrara

Dear lferrara ,

Yes i have : the only difference is, we have selected "connection security" as "simple".

let me describe scenario:

Before STAS:

we had configured AD already. we imported some AD groups and some test users (not all). i have been testing firewall policies with those users and they always showed up with captive portal authentication. policies were working fine

After STAS:

now AD users are being populated in "USERS" section automatically (not all of them). i still get the captive portal screen on any user. we have already added users in firewall policy in "match users".

now i have two questions :

should i be getting that captive portal screen after installing STAS on AD ? if not then what could be wrong ?

will i get all my current AD users automatically or do i have to manually import them ?
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 8 years ago in reply to FaheemSarwar

For AD users, you have to import them.

For the captive portal, can you show your policy rules how they look like?
Cancel
Vote Up 0 Vote Down

Cancel
0 FaheemSarwar over 8 years ago in reply to lferrara

dear

does it help :
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 8 years ago in reply to FaheemSarwar

Is this rule the first one?
Cancel
Vote Up 0 Vote Down

Cancel
0 FaheemSarwar over 8 years ago in reply to lferrara

Dear lferrara

yes it is.

Regards,

Faheem
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 8 years ago in reply to FaheemSarwar

Faheem,

adjust the rule where only HTTP and HTTPS are allowed. After that create a deny rule below this one where LAN to WAN and HTTP/HTTPS are denied.

Give us the result.
Cancel
Vote Up 0 Vote Down

Cancel
0 FaheemSarwar over 8 years ago in reply to lferrara

Dear Mr. Ferrara,

Thank you for your reply. it turned out to be mismatch in "NetBIOS Domain" in Appliance & STAS client.

P.S. from my opinion & experience, the captive portal screen after enabling STAS appears when client machine have "some" problem in reaching the server where STAS client is installed. although the user on that machine appears in "live users". (strange).

regards,

Faheem
Cancel
Vote Up 0 Vote Down

Cancel