How to sync Active Directory with Sophos XG 115

Question

Hello everyone, 
 
 I am new with Sophos solutions, expecially with XG Firewalls. 
 I have a customer that bought a XG 115 recently and they would like to create some restrictions to user navigation on internet. 
 The first thing that I am not able to do is the Active Directory sync with the XG 115 to be able to configure groups of permissions. 
 I already added the Server and tested the connection successfully, but when I try to purge the users from Active Directory, I am receiving the following message:

Can someone help me with that? Maybe as I am new with these configurations, I am missing something.

ChrisKnight · Answer

Howdy, 
 Unless you've lowered the security on your DC(s), you will need to configure the XG to use STARTTLS instead of Plaintext. 
 If you don't have a certificate on your DC(s) that match the FQDN of the DC(s), then you will need to install one. The following links are useful for doing this: 
 https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/enable-ldap-over-ssl-3rd-certification-authority 
 https://social.technet.microsoft.com/wiki/contents/articles/2980.ldap-over-ssl-ldaps-certificate.aspx 
 Once you can successfully connect to the DC(s) via LDAPS using LDP.EXE, then you can configure the XG for STARTTLS. 
 You may also want to change the server name to procat.local - this will allow you to query any DC in the domain, rather than a specific DC. Useful for DC failover. 
 You can also change the search query to only interrogate a specific OU - helps prevent polluting the XG with service accounts.

How to sync Active Directory with Sophos XG 115

Top Replies