Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 4 subscribers
  • Views 2785 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Problem with SSL-Connection

BeEf

Good morning,

we have strange Problems with our SSL-VPN Connection to the sophos.

We have approximately 300 users SSL-VPN eanbled. Usually =<20 users are logged on concurrently.

 

Some of our users have problems to logon to the SSL-VPN. Obvisiously the connection from their login to the OTP Token is messed up.

 

In this case the following happens:

- When the user is loging on to the userportal he only needs his login + password to login (formerly it was initalized and the password+OTP was needed).

- Then most time a new OTP Token is created (In Definitions and Users - Authentication Services - One Time Password)

- The user is now able to login with both combinations login / password + old otp and login / password + new otp on the user portal (the user now has two valid OTP token)

- After this the SSL-VPN login is possible with both combinations. However this is only the true for most of the logins. Some are still not working. Clearing the authentication cache does not help in this case.

The OTP Tokens are prepopulated based on an AD connection and the membership in a group (VPNLoginPassToken).

Obviously the firewall loses the connection between the old OTP Token and the user or to be more clearer it goes through the token initialization process of the users.  We are quite sure that this is an issue of the implementation of Sophos parts and not from the underlying SSL-VPN (we do not change something on the client software).

This happend half a year ago and again on last friday. The firmware running on the sophos was 9.503-4. We updated to 9.506-2 which did not change anything. We don't want to install newer version for the moment because of the S/MIME Encryption issue seems not to be fixed so far.

 

Has somebody else this or a similar problem?

Is there any way to identify which of the 300 accounts are affected?

What could be the trigger that let the software think that the token of a user needs to be reinitialized?

 

Best regards,

Bernd

 



This thread was automatically locked due to age.
Parents
  • 0

    Good afternoon,

    related to my post last week I'd like to ask (maybe there is a developer from sophos in here) what excactly happens if a VPN 2-Factor enabled and initialized user loses his membership in the AD group that enables him to do a 2-factor authentication and then is readded to this group again.

    There are 2 cases

    a) the user has tried to logon during the time when he was not member in the group

    b) the user has not tried to logon during the time when he was not member in the group

    It would explain 80% of our problems as some external users were removed from the group and readded. As there is already an an entry for an authentication token in the database / connected to the user we would expect that the 2 factor authentication wourld work again after readding him or her to the group. Not to forget to wait some time for the synchronization and clearing the authentication cache. 

    However we migth be wrong and the user needs to go through the autentication process again. This would explain the problems in 80% the cases but not all.

    Best regards,
    Bernd

Reply
  • 0

    Good afternoon,

    related to my post last week I'd like to ask (maybe there is a developer from sophos in here) what excactly happens if a VPN 2-Factor enabled and initialized user loses his membership in the AD group that enables him to do a 2-factor authentication and then is readded to this group again.

    There are 2 cases

    a) the user has tried to logon during the time when he was not member in the group

    b) the user has not tried to logon during the time when he was not member in the group

    It would explain 80% of our problems as some external users were removed from the group and readded. As there is already an an entry for an authentication token in the database / connected to the user we would expect that the 2 factor authentication wourld work again after readding him or her to the group. Not to forget to wait some time for the synchronization and clearing the authentication cache. 

    However we migth be wrong and the user needs to go through the autentication process again. This would explain the problems in 80% the cases but not all.

    Best regards,
    Bernd

Children
No Data
Unfiltered HTML