Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 13 replies
  • Answers 1 answer
  • Subscribers 30 subscribers
  • Views 1420 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

AD SSO not working without proxy on Sophos XG 18.0.1 MR-1-Build396

Moeed Aziz

Hi,

We have setup proxy on client computer for the sophos xg and AD SSO in place and it just works fine; user starts browsing, gets seemlessly authenticated via AD SSO and surfs on...

Now my organization wants to get rid of proxy settings, the traffic goes to the router and the router segregate internet traffic and sends it to sophos but sophos is not passing traffic. When i checked logs, i found out that there is not log from the specific user and when i check the authentication logs there is not authentication request either for that user. Once i add proxy, AD SSO kicks in, user gets authenticated and now its synced into Sophos. Now if i even remove the proxy the browsing is just fine.

What can be the reason that when traffic from a new AD user directly reaches the firewall (and not via proxy setup), it does not get authenticated and does not get internet either. How can i make this work. 

I hope i am making sense, if not, please feel free to ask any question.

ps. i even tried setting up Sophos as gateway IP for the client and still no good.

regards,

Moeed



This thread was automatically locked due to age.
  • 0

    Maybe you router does some kind of NAT? So the Sophos firewall thinks the request is coming from there?

    Mit freundlichem Gruß, best regards from Germany,

    Philipp Rusch

    New Vision GmbH, Germany
    Sophos Silver-Partner

    If a post solves your question please use the 'Verify Answer' button.

  • 0

    Hello ,

    Thank you for reaching out to the community, I would request you to upgrade the firmware to v18.5.4 MR-4 the latest build:
    The current firmware you are using is already declared EoL 

    Major software version End-of-Life notification End-of-Life (EOL)
    SFOS 18.0             18-JAN-2022          31-JUL-2022

    ============================================================
    Please refer the retirement calendar below: 


    If the reported problem persist even after the firmware upgrade please let us know here !!

    Thanks & Regards,
    _______________________________________________________________

    Vivek Jagad | Team Lead, Global Support & Services 


    Sophos Community | Product Documentation | Sophos Techvids | SMS
    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to jprusch

    No Natting on router. The default route sends all the internet traffic to sophos firewall IP.

  • 0 in reply to Vivek Jagad

    I tried 18.5.4 but it causes "Can't establish NTLM authentication channel with" domain controller.

    18.0.1 works just fine for me other than the issue mentioned above.

  • 0 in reply to Moeed Aziz

    Hey ,

    Can you share the screenshot of the error you are receiving and logs from the advance shell:
    tail -f /log/nasm.log 
    Log file details: https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Logs/LogFileDetails/index.html

    Thanks & Regards,
    _______________________________________________________________

    Vivek Jagad | Team Lead, Global Support & Services 


    Sophos Community | Product Documentation | Sophos Techvids | SMS
    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Vivek Jagad

    Below is the output of the command:

    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    winbindd version 4.7.4 started.
    Copyright Andrew Tridgell and the Samba Team 1992-2017
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    initialize_winbindd_cache: clearing cache and re-creating with version number 2
    Could not fetch our SID - did we join?
    unable to initialize domain list
    Sep 21 15:01:56.507528 [nasm] is_ad_server_alive: waitpid() failed for 'No chi ld processes'

    Sep 21 15:02:16.851228 [nasm] is_ad_join_required() AD join NOT required due t o no change in smb.conf
    Sep 21 15:02:17.377501 [nasm] channel established successfully
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    winbindd version 4.7.4 started.
    Copyright Andrew Tridgell and the Samba Team 1992-2017
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    initialize_winbindd_cache: clearing cache and re-creating with version number 2
    Could not fetch our SID - did we join?
    unable to initialize domain list
    Sep 21 15:02:19.377665 [nasm] is_ad_server_alive: waitpid() failed for 'No chi ld processes'
    Sep 21 15:02:39.721640 [nasm] is_ad_join_required() AD join NOT required due to no change in smb.conf
    Sep 21 15:02:40.255921 [nasm] channel established successfully
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    winbindd version 4.7.4 started.
    Copyright Andrew Tridgell and the Samba Team 1992-2017
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    initialize_winbindd_cache: clearing cache and re-creating with version number 2
    Could not fetch our SID - did we join?
    unable to initialize domain list
    Sep 21 15:02:42.256068 [nasm] is_ad_server_alive: waitpid() failed for 'No child processes'
    Sep 21 15:03:02.582596 [nasm] is_ad_join_required() AD join NOT required due to no change in smb.conf
    Sep 21 15:03:03.111373 [nasm] channel established successfully
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    winbindd version 4.7.4 started.
    Copyright Andrew Tridgell and the Samba Team 1992-2017
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    initialize_winbindd_cache: clearing cache and re-creating with version number 2
    Could not fetch our SID - did we join?
    unable to initialize domain list
    Sep 21 15:03:05.111553 [nasm] is_ad_server_alive: waitpid() failed for 'No child processes'
    Sep 21 15:03:25.454555 [nasm] is_ad_join_required() AD join NOT required due to no change in smb.conf
    Sep 21 15:03:25.982778 [nasm] channel established successfully
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    winbindd version 4.7.4 started.
    Copyright Andrew Tridgell and the Samba Team 1992-2017
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    initialize_winbindd_cache: clearing cache and re-creating with version number 2
    Could not fetch our SID - did we join?
    unable to initialize domain list
    Sep 21 15:03:27.982958 [nasm] is_ad_server_alive: waitpid() failed for 'No child processes'
    Sep 21 15:03:48.326699 [nasm] is_ad_join_required() AD join NOT required due to no change in smb.conf
    Sep 21 15:03:48.863260 [nasm] channel established successfully
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    winbindd version 4.7.4 started.
    Copyright Andrew Tridgell and the Samba Team 1992-2017
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    initialize_winbindd_cache: clearing cache and re-creating with version number 2
    Could not fetch our SID - did we join?
    unable to initialize domain list
    Sep 21 15:03:50.863424 [nasm] is_ad_server_alive: waitpid() failed for 'No child processes'
    Sep 21 15:04:11.209236 [nasm] is_ad_join_required() AD join NOT required due to no change in smb.conf
    Sep 21 15:04:11.746588 [nasm] channel established successfully
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    winbindd version 4.7.4 started.
    Copyright Andrew Tridgell and the Samba Team 1992-2017
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    initialize_winbindd_cache: clearing cache and re-creating with version number 2
    Could not fetch our SID - did we join?
    unable to initialize domain list
    Sep 21 15:04:13.746754 [nasm] is_ad_server_alive: waitpid() failed for 'No child processes'
    Sep 21 15:04:34.083844 [nasm] is_ad_join_required() AD join NOT required due to no change in smb.conf
    Sep 21 15:04:34.609722 [nasm] channel established successfully
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    winbindd version 4.7.4 started.
    Copyright Andrew Tridgell and the Samba Team 1992-2017
    Failed to create /var/log/samba/cores for user 0 with mode 0700
    Unable to setup corepath for winbindd: Success
    initialize_winbindd_cache: clearing cache and re-creating with version number 2
    Could not fetch our SID - did we join?
    unable to initialize domain list
    Sep 21 15:04:36.609885 [nasm] is_ad_server_alive: waitpid() failed for 'No child processes'
    ^C

  • 0 in reply to Moeed Aziz

    Hey ,

    Can you disable the AD SSO under the administration > device access > for the LAN zone if enabled and then check if the error persists ? 

    Thanks & Regards,
    _______________________________________________________________

    Vivek Jagad | Team Lead, Global Support & Services 


    Sophos Community | Product Documentation | Sophos Techvids | SMS
    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Moeed Aziz

    you mean you are still getting the errors under the log viewer > authentication section: "Can't establish NTLM authentication channel with" domain controller." 

    Thanks & Regards,
    _______________________________________________________________

    Vivek Jagad | Team Lead, Global Support & Services 


    Sophos Community | Product Documentation | Sophos Techvids | SMS
    If a post solves your question please use the 'Verify Answer' button.

  • +1 in reply to Moeed Aziz

    Hi ,

    In 18.5 MR4, can you please run the following command from the advanced shell?

    opcode -ds nosync nasm_cleanup

    This should address the issue where the firewall is failing to join the domain by forcing a re-initialization of the nasm service/environment.

    Thanks,
    Peter Gale | Director, Software Development, NSG

    Peter Gale | Director, Software Development, NSG
    peter.gale@sophos.com

Unfiltered HTML