Unable to Join Active Directory in XG Firewall

You could start with the Tcpdump to check, if its a XG or AD issue. 

https://community.sophos.com/products/community-chat/f/knowledge-base-article-suggestions/105811/how-to-tcpdump-on-xg

Simply dump in file with port 389. 

tcpdump -ni any port 389 -s0 -b -w /tmp/dump.pcap 

And try to authenticate yourself. 

Download this file like mentioned in my post and open it in wireshark. 

Hi,

sorry for my late answer, i was very busy in the last days.

I checked the pcap-File and i find something. My DC (Synology) send a RST Flag at the End of the communication. It seems thats the error, but how can i fix it?? :(

Bye, Timo

Edit: If I try a connection with connectionsecurity "easy" the TCP Stream tells me, that a strong auth required is...

I think, now it is getting a little bit complicated, but lets try it. 

Please do not post screenshots / wireshark dumps here! There can / may contain sensible data / content like passwords etc.

You should find something called "Bind request" and "bind response" in your dump.

https://osqa-ask.wireshark.org/questions/42719/filter-binding-request

The Request comes from XG to the AD. AD will respond with the bind response.

This Bind response contains something in wireshark, which will lead you to your answer. You can simply expand everything in the data part of Wireshark to find the answer. 

https://ldap.com/ldap-result-code-reference/

Hey,

In the first TCP-Stream are no bind requests or bind responds. I only saw that in the TCP-Stream with the lower connection security. There i get the message, that a stronger auth is required. If i try with SSL/TLS security, there a no bind requests/responds in the Stream...

Ok. With SSL / TLS Required, you have no chance to debug this in this setup.

You need to deal with the access server.

https://community.sophos.com/kb/en-us/132211

community.sophos.com/.../123185

I've looked into the Access_Server.log with "tail -f /log/access_server.log". After i hit the "Test Connection"-Button i get 2 logfile entries:

adsauth_bind: bind failed: Can't contact LDAP Server

adsauth_test_auth:"DC_IPADRESS:389": bind failed for user: "xxxxxxxxxxx"

the other log entries are only access_server heartbeats (every 45 seconds)

Try to set the access_server into debug mode:

service access_server:debug -ds nosync

Same command to disable the debug mode.  

Hi Timo,

regards from Duisburg.

Please check this article - should be convenient for you as it is in german. This article solved my Synology RS815+ losing AD connection with XG after some DSM Upgrade.

https://www.synology-forum.de/showthread.html?98787-Active-Directory-Packet-LDAPS-SSL-Port-636-nicht-aktiviert-gel%C3%B6st

Please remember your backups prior to change config.

Hi Martin,

thank you so much! This helped me perfect! I can now Join the AD with Port 636 and SSL - Nice!

Thank you ManBearPig, too!

Have a nice weekend and merry christmas.

Timo