SF Authentication behavior after STAS

Faheem,

did you follow the entire article? inside the KB you will find another KB:

https://www.sophos.com/en-us/support/knowledgebase/123155.aspx and then https://www.sophos.com/en-us/support/knowledgebase/123158.aspx

You should install STAS on every domain that you want to manage. Install it at least on 2 DC for failover. https://www.sophos.com/en-us/support/knowledgebase/123154.aspx

So when you create the Policy rule, inside the Match Users you are able to select the imported groups/users and the captive portal will not appear anymore.

Dear lferrara ,

Yes i have : the only difference is, we have selected "connection security" as "simple".

let me describe scenario:

Before STAS:

we had configured AD already. we imported some AD groups and some test users (not all). i have been testing firewall policies with those users and they always showed up with captive portal authentication. policies were working fine

After STAS:

now AD users are being populated in "USERS" section automatically (not all of them). i still get the captive portal screen on any user. we have already added users in firewall policy in "match users".

now i have two questions :

should i be getting that captive portal screen after installing STAS on AD ? if not then what could be wrong ?

will i get all my current AD users automatically or do i have to manually import them ?

Dear lferrara ,

Yes i have : the only difference is, we have selected "connection security" as "simple".

let me describe scenario:

Before STAS:

we had configured AD already. we imported some AD groups and some test users (not all). i have been testing firewall policies with those users and they always showed up with captive portal authentication. policies were working fine

After STAS:

now AD users are being populated in "USERS" section automatically (not all of them). i still get the captive portal screen on any user. we have already added users in firewall policy in "match users".

now i have two questions :

should i be getting that captive portal screen after installing STAS on AD ? if not then what could be wrong ?

will i get all my current AD users automatically or do i have to manually import them ?

For AD users, you have to import them.

For the captive portal, can you show your policy rules how they look like?

dear

does it help :

Is this rule the first one?

Dear lferrara

yes it is.

Regards,

Faheem

Faheem,

adjust the rule where only HTTP and HTTPS are allowed. After that create a deny rule below this one where LAN to WAN and HTTP/HTTPS are denied.

Give us the result.

Dear Mr. Ferrara, 

Thank you for your reply. it turned out to be mismatch in "NetBIOS Domain" in Appliance & STAS client.

P.S. from my opinion & experience, the captive portal screen after enabling STAS appears when client machine have "some" problem in reaching the server where STAS client is installed. although the user on that machine appears in "live users". (strange).

regards,

Faheem