Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 27 subscribers
  • Views 452 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

STAS SSO at Branch Office

Dan Becker1

Head Office has XG125 18.0.5. HO contains Active Directory Server.

Branch Office has XG106 18.0.5

HO has STAS configured and working. Live users are reported in XG, all is working.

BO can reach reach HO via server/client RED tunnel.

BO user workstations are members of same Domain, they currently authenticate to HO AD Server.

I want the BO live users reported in XG so we can apply user policies. I read this KO: https://support.sophos.com/support/s/article/KB-000035620?language=en_US

But a prerequisite is site-to-site IPsec  tunnel for XG Firewall initiated traffic. Is this required eventhough we already have XG RED tunnel established?

I added BO network and XG appliance IP in STAS (AD server) but the BO XG IP never shows up on STAS General tab.

Any help appreciated. thanks.



This thread was automatically locked due to age.
Parents
  • FormerMember
    0 FormerMember

    Hi ,

    Thanks for reaching out to the Community! 

     Have you added the RED network range to STAS monitored networks? Also, is client authentication and captive portal selected for the configured zone under Administration > Device Access?

    Thanks,

  • 0 in reply to FormerMember

    In STAS on AD server, I see users from BO listed under Advanced tab / Show Live Users.

    No, I only added the BO LAN, not the RED /30 subnet between BO and HO. I just added that /30 subnet and still don't see live users on BO XG.

    Yes, captive portal and client auth. are both checked on the BO XG under Device Access.

Reply
  • 0 in reply to FormerMember

    In STAS on AD server, I see users from BO listed under Advanced tab / Show Live Users.

    No, I only added the BO LAN, not the RED /30 subnet between BO and HO. I just added that /30 subnet and still don't see live users on BO XG.

    Yes, captive portal and client auth. are both checked on the BO XG under Device Access.

Children