Sophos Connect Authentication failed | Sophos VPN SSL Client works

Hello Erik,

Thank you for your query, from the shell can enter the command: net ads info

And also check the time on the client machine and the AD servers are up to the mark or not ?
Also check if the username is not case sensitive. 

I was curious so i tried the shell right now. But the shell access is limited.

Can i provide you the needed information on another way?

That way, will be able to know the offset value between the appliance and the AD server.
Well, limited by the network right? Can you add your public IP under the shell access allowed network and then you can login and enter the command mentioned ?

<M> loginuser@utm:/home/login > net ads info
-bash: net: command not found

enter su
and then type the root password
and then enter the cmd under root# net ads info 

Ok, sorry i am not very familiar with these type of access.

I think the info you need is:

Server time offset: 0

Yes that's right and that looks okay by any chance, are you using any OTP config with the SSL VPN settings ?

Yes that's right and that looks okay by any chance, are you using any OTP config with the SSL VPN settings ?

Yes, we use OTP. But for testing i deactivated it for my test user (depends on specific user group in ad). But still the same.

Sophos VPN SSL Client works. Sophos Connect does not.

Try deleting the OTP token for that user, create again and then try connecting it again. 

I deleted the OTP token, put the user in the OTP group and created a new token.

But still the same. The Authentication Services Live Log shows that all dc servers where tried. If I access the same user via User Portal the log shows that only the first ad server is asked and then access is allowed.

Can you share the tail -f /var/log/aua.log [from the shell access] when trying to connect with the vpn client...?

Is this any different than the logs downloaded via web access?

e.g. "View Logfiles" > "SSL VPN"

Because this would be easier for me then trying the shell. But if recommended i can do so.

Can I pm you these outputs? I'm uncomfortable with posting that public.

Sure, pm me let me take a look into the logs once...

Thanks to Vivek we found the problem.

We use passwords with space witch where never a problem with the old client. But they are with the new one.

I don't now why they changed this. Exclude characters from passport possibilities is never a good thing. And it harms our company password policy.

Thank you Erik Puscher

As there is an investigation going on NCL-1319,NCL-1507 where the issue will be fixed in Sophos connect 2.3