Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 28 subscribers
  • Views 1381 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

STAS Best Practice

TI Silvestrin

Hello,

I have 2 DCs and 5 XG firewalls conected with a VPN.

All my users, regardless the company, are appearing in all appliances.

The question is: Can I have 5 STAS, each one answering to a specifyc network range and connected to it specyfic appliance?

I have 2x 230, 3x 106 and 1x 86.

Best Regards,



This thread was automatically locked due to age.
Parents
  • 0

    As far as I understands how STAS works, it just reads the DC security event log and sends the user, user's logon / log off event and associated IP address to the XG when querried. The XG and Firewall rules will do the rest with the result set. When there are performance issues with reading the event log on the DC the identity probe by the XG will fail.

    Can your user's be logged on to devices in multiple vlans at the same time and no seperate DC per VLAN?  Have you tested it? I am not sure if that will confuse the STAS query results. 

    STAS is EOL and no word yet on a replacement.

  • 0 in reply to Fred_B

    STAS is not EoL. SATC is going to be End of Life (31.07). SATC is the terminal server solution and will be migrated to Intercept X for server. 

    STAS (collector) is also using WMI to check, if the user is still online. 

    You can install multiple STAS agents to query the DC and one Collector to pump the data to all XGs. 

Reply
  • 0 in reply to Fred_B

    STAS is not EoL. SATC is going to be End of Life (31.07). SATC is the terminal server solution and will be migrated to Intercept X for server. 

    STAS (collector) is also using WMI to check, if the user is still online. 

    You can install multiple STAS agents to query the DC and one Collector to pump the data to all XGs. 

Children
  • 0 in reply to LuCar Toni

    Hi LuCar Toni,

    You are right I am mixing up SATC / STAS as we have that issue.

    We are still waiting for news on the migration of SATC to Intercept X for Sever. Currently STAS SSO and Web Proxy works when I am logged on to my pc. When I also connect from the pc to the RDS server and login and use the web proxy it will throw random category page blocks. It do not have that issue when I VPN in and connect to the RDS. In the log I show up with my PC IP and the RDS server IP. So a user showing with multiple IP adresses will cause problems. In our case it is in the same VLAN

    Regards,

    Fred