How to sync Active Directory with Sophos XG 115

Howdy,

Unless you've lowered the security on your DC(s), you will need to configure the XG to use STARTTLS instead of Plaintext.

If you don't have a certificate on your DC(s) that match the FQDN of the DC(s), then you will need to install one. The following links are useful for doing this:

https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/enable-ldap-over-ssl-3rd-certification-authority

https://social.technet.microsoft.com/wiki/contents/articles/2980.ldap-over-ssl-ldaps-certificate.aspx

Once you can successfully connect to the DC(s) via LDAPS using LDP.EXE, then you can configure the XG for STARTTLS.

You may also want to change the server name to procat.local - this will allow you to query any DC in the domain, rather than a specific DC. Useful for DC failover.

You can also change the search query to only interrogate a specific OU - helps prevent polluting the XG with service accounts.

Hello ChrisKnight,

I followed your instructions, created a certificate and tested the connection with the Server using the STARTLS, but on the purge users function, I am still receiving the following error:

Any other advice? Thank you!

Can you successfully connect to the DC via LDAPS using LDP.EXE from another Windows Server / Desktop? And can you authenticate the LDAP Bind using the same credentials you've specified, also using LDP.EXE?

Using the LDP, I was able to connect using the hostname of server: PROCAT-SRV01

But, when I attempted to connect using the IP address, I was unable.

On XG 115, I have tried to change the Server IP/domain to procat.local, but no success.

Any idea from what I can do?

Hi Rodrigo Gulkas1,

Is the configured AD username has admin privileges? I know the connection test isn't failing with certain configurations, but when you try to purge the AD users, the logs would tell us more about the reason for the error.

We would need the csc, access_server logs in debugging and applog while you replicate the issue. You can send me the logs via personal message. 

Thanks,

Thank you Harsh Patel,

Is there any documentation about how to export these logs? Or where I can found them?

Sorry, I am learning about Sophos, I do not have too much expertise.

About the "multipoint" user, yes. This user have the following groups on AD:

Administrators

Company Administrator

Domain Administrator

Hyper-V Administrator

Remote desktop user

Domain user

(sorry if some translation from Brazilian Portuguese to English is wrong)

Thank you Harsh Patel,

Is there any documentation about how to export these logs? Or where I can found them?

Sorry, I am learning about Sophos, I do not have too much expertise.

About the "multipoint" user, yes. This user have the following groups on AD:

Administrators

Company Administrator

Domain Administrator

Hyper-V Administrator

Remote desktop user

Domain user

(sorry if some translation from Brazilian Portuguese to English is wrong)

Hello there,

You can follow this KB to export the logs.

The logs are located under the /log directory.

Regards,

Thank you Emmanuel.

I already sent the files to Harsh Patel.