Active Directory Authentication with XG failing.

Hi Ronald Chinomona1

Please check with Connection security as Plain Text on AD integration under  CONFIGURE--->Authentication > Servers

Configure the branch office Sophos Firewall to prompt VPN traffic for authentication
By default, Sophos Firewall prompts unauthenticated traffic for clientless SSO from the LAN/DMZ zone. Since STAS at the head office serves login requests from the branch office over VPN, you must configure the branch office Sophos Firewall to prompt the sign-in requests.

Sign in to the command line using Telnet or SSH. You can also access it from admin > Console in the upper-right corner of the web admin console.
Choose option 4. Device Console.
Run the following command to add the branch office network to STAS.

system auth cta vpnzonenetwork add source-network 172.50.50.0 netmask 255.255.255.0

Note

Administration > Device Access > Local Service ACL > Client Authentication must be turned on for the VPN zone.

Routing Sophos Firewall-initiated traffic
Add an IPsec route at the Branch Office and apply a Source NAT policy on its Sophos Firewall-initiated traffic so that its source IP address is internal:

console> system ipsec_route add host <IP Address of host> tunnelname <tunnel>

Run the command below to NAT the Sophos Firewall traffic to the desired public IP with the private LAN IP:

set advanced-firewall sys-traffic-nat add destination <Destination IP/Network> snatip <NATed IP>

Hi Ronald Chinomona1 Thank you for reaching out to the Sophos community team. Probably the XG for which the AD test connection is failing may be missing the below settings:

Route Sophos Firewall-initiated traffic through an IPSec VPN tunnel

https://support.sophos.com/support/s/article/KB-000035839?language=en_US

If settings have been already done, you may capture the Packet capture from GUI, TCPDUMP on XG CLI, and Conntrack from the non-working location XG end during test connection time to validate it further.

Hello Bharat J and Vishal_R Thank you for your responses which are somewhat similar. I have added an IPsec route at the Branch Office and applied a Source NAT policy. I have reviewed the logs in the XG at the  Head Office and I noticed that the XG actually processes the traffic but drops it as IP Spoofing. Why would the XG treat the AD connection traffic coming through an IPSEC tunnel as IP spoofing. The source address is the LAN IP of the XG at the the branch office and the destination is the IP of AD server on Port 389. I have attached a picture of my topology.

Hi Ronald Chinomona1 

Please go to PROTECT --->Intrusion Prevention -->Dos and Spoof Prevention and disable the Spoof prevention under Spoof protection general settings and check ?

Thanks and Regards

I have no Spoof Prevention enabled for any zone.

Hi Ronald Chinomona1 

Please check AD settings with Connection security with Plain and SSL /TLS and check the status?

I have plain text connection security and port 389 configured. The exact same setting work well on another XG that sits in the same LAN with the AD server.