Hello everyone,
I apologize ahead of time in case none of this makes sense. I'll start with some background info.
We implemented MFA not too long ago on our SSL VPN connections. Our Sophos XG is configured to use AD credentials to authenticate.
A common issue with Sophos SSL VPN with MFA is that if the client needs to reauthenticate due to a disconnect (for whatever reason), the client will fail to reconnect.
Without MFA, it would reconnect just fine. But since MFA requires an active token to be entered, our logs show that the client failed to connect due to wrong credentials since the OTP used to authenticate initially is no longer valid. This kind of happens in the background and the user has no idea what went wrong.
Why would the VPN connection disconnect and force the client to reauthenticate thus failing because the OTP has likely changed since the initial login?
Well, I'm still working on that issue. However, something I thought about was whether or not the NTP settings made a difference or not.
Our Sophos XG uses a public NTP server "pool.ntp.org"
Our AD Domain Controller uses "us.pool.ntp.org", which our clients also use.
Would it then make sense to point both my Sophos XG and Domain Controller to the same NTP server? This would help me reduce the chances of there being an issue with time syncronization. I tried comparing the differences between the two NTP servers outlined above using the following command:
C:> w32tm /monitor /computers:us.pool.ntp.org,pool.ntp.org
Output:
us.pool.ntp.org[154.16.245.246:123]:
ICMP: 89ms delay
NTP: -0.0623971s offset from local clock
RefID: t2.time.bf1.yahoo.com [72.30.35.88]
Stratum: 3
pool.ntp.org[64.79.100.197:123]:
ICMP: 69ms delay
NTP: -0.0555927s offset from local clock
RefID: ntp.your.org [204.9.54.119]
Stratum: 2
But it doesn't look like there would be any significant differences that would have an impact on user connectivity.
In short, does NTP matter at all? Does having a different NTP server on my domain controller (thus my clients) and my Sophos XG firewall make a difference with authenticating via SSL VPN with MFA?
This thread was automatically locked due to age.
