Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

AD SSO not working without proxy on Sophos XG 18.0.1 MR-1-Build396

Hi,

We have setup proxy on client computer for the sophos xg and AD SSO in place and it just works fine; user starts browsing, gets seemlessly authenticated via AD SSO and surfs on...

Now my organization wants to get rid of proxy settings, the traffic goes to the router and the router segregate internet traffic and sends it to sophos but sophos is not passing traffic. When i checked logs, i found out that there is not log from the specific user and when i check the authentication logs there is not authentication request either for that user. Once i add proxy, AD SSO kicks in, user gets authenticated and now its synced into Sophos. Now if i even remove the proxy the browsing is just fine.

What can be the reason that when traffic from a new AD user directly reaches the firewall (and not via proxy setup), it does not get authenticated and does not get internet either. How can i make this work. 

I hope i am making sense, if not, please feel free to ask any question.

ps. i even tried setting up Sophos as gateway IP for the client and still no good.

regards,

Moeed



This thread was automatically locked due to age.
  • Hi Moeed,

    We are going to need more information and logs. The snippet of the logs you included shows an ongoing problem caused by an earlier error. We need to see the earlier error.

    Can you please do the following:

    # clear the log file
    > /log/nasm.log

    # reset all of nasm
    opcode -ds nosync nasm_cleanup

    Wait one minute. Then take a look at nasm.log. Can you post the entirety of the log file (or at least from the top to where the repeated loops occur).

    Can you screenshot what the Administration > Device Access is? If AD SSO was disabled on all Zones it should have caused nasm to stop connecting to the AD server.

    One of the changes between 18.5 MR1 and MR4 is that AD SSO better follows the Authentication > Server configuration for Connection Security / Port. Another thing to try would be (if it is not already) changing the setting to plaintext on port 389.