XG Firewall adds User to Group without AD interaction

Mirco Odau As you mentioned the user must be getting authenticated from AD via firewall. If so, then the user must be a part of the VPN group on AD already that is the reason they are getting added to the VPN group on the firewall based on the authentication replies we get from the AD server. 

Hi Kishan,

problem is: they are not in the ad group. i can create a new user in the domain without any groups and i can use it to log in into the firewall and download vpn packages. 

The XG shows that new account in the vpn group. If i take a look into ad it is still not there

Hi Mirco Odau : What is the default group set on XG? Is it set to "VPN group" or any other group? If yes for "VPN group" then if for any user over XG if no matching group found on XG , the user will become part of the Default group 

I believe the above could be the possible reason for your scenario. 



If the user has no VPN settings then the policy defines on the group will be applied to users.

Hi Vishal_R ,

Default Group is set to VPN:

and VPN Setting:

Also authentication is set to Local AND the DC

So if a user logs into the firewall with AD credentials and is NOT member of the ad group VPN he will be added to the Sophos Group VPN (which is the local ad group) because it is set as default group?

Kind regards
Mirco

Hi Mirco Odau : Yes correct as the default group is "VPN - User"  whenever the user login the first time with any method it will become part of that group and the policy applied to that group will be applicable to the user. 

So you may change the default group to any other group where you have not applied any VPN policy then the user will be part of that default group and VPN policy will not be applied. 

Okay Thank you very much!