Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 17 replies
  • Subscribers 33 subscribers
  • Views 72064 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

STAS & XG

scaledem

Hello,

I have an issue with the authentication.
On my STAS i got my live users cf screen1

.
On the UTM i dont see any users cf screen2.


On the XG console i typed the following commands :
#system auth cta enable
#system auth cta collector add collector-ip 172.16.17.20 collector-port 6677 create-new-collector-group

( 172.16.17.20 is the IP of my AD)

The firewall rules are any/any/any.

I dont know how to troubleshoot more except the connection test cf screen3.

Any ideas?



This thread was automatically locked due to age.
Parents
  • 0

    Scale,

    Did you create the authentication server under System > Authentication > Authentication Server?

    Follow this guide:

  • 0 in reply to lferrara

    Hum i changed the interface IP for the collector and it works now.

    Thank for you help

  • 0 in reply to scaledem

    Hi,

    Furthermore, you may bypass UDP ports 6677, 5566 and 6060 from Advance Firewall options withing AD server to allow communication between STAS controller and Sophos XG.

  • 0 in reply to scaledem

    Hi scale,

    I'm in your same situation, but cna't figure how to solve it. What do you mean that you have changed the interface IP? Changed the collector/serve ip?

    Many thanks

  • 0 in reply to SicorS.p.A.

    Sic,

    follow the guide and all other links inside. I have configured several STAS and SATC without issue.

  • 0 in reply to SicorS.p.A.

    Hey, I had two networks, i changed the IP from 172.16.16.16 to another interface : 172.16.17.16, but it doesn't make sense. I would not be surprised if my virtual switch bugged me on this one. Good luck!

  • 0 in reply to scaledem

    Hi,

    Here why you need to change interface IP in controller, let me explain!!

    Lets say, you have two Interfaces on XG, one is PortA (LAN Zone) with IP address 172.16.16.16/24 and PortC (DMZ Zone) with IP address 192.168.1.1/24.

    Lets assume your AD server is in DMZ zone and in that you may have installed STAS.

    Now, ideally, administrators configure LAN zone IP as Cyberoam IP in STAS controller which is 172.16.16.16, as per this example.

    In XG, you may have added controller IP 192.168.1.2(For ex.).

    Now, request from XG to Controller is like source IP as 192.168.1.1 and destination as 192.168.1.2 on port 6677.

    So, in such case, your STAS would get failed to authenticate users, as in controller XG IP is 172.16.16.16, not 192.168.1.1.

    So, finally you need to change XG IP as 192.168.1.1 in controller, as request is coming from that IP address on AD server. This is the reason why you may need to change IP in controller.

    Best of Luck!!!!!

  • 0 in reply to AvinashPanchal

    Dear Avinash,

    I have configured same but my AD server already in Lan and other port is DMZ 

    Port A is - Lan -172.16.33.1 and AD server IP - 172.16.33.121  i have configure STAS in AD Agent and controller are testing done and Firewall testing done but issue we are facing my add user not able to access internet even I'm not able to see any logs in my firewall so please suggest what action should i take for the same 

    Deepak Kumar Patidar

  • 0 in reply to AvinashPanchal

    My AD Authentication is working, but I have always about 50% of firewall traffic by user N/A... so this is like having it not working unfortunately...

    anyway, in your KB, you haven't written the users exclusion  method (black list) that in my case is necessary due to Arcserve Backup Software. In Cyberoam KB you could find it in the CTAS troubleshooting and I think it is necessary to add also in Sophos STAS KB. Just my 2 cents

  • 0 in reply to DeepakPatidar

    Hi Deepak,

    Please, follow below steps for further troubleshooting:

    1. Verify if AD server IP is correct in XG telnet console. Also, cross verify in AD server with XG IP address.

    2. Verify DN name in AD integration if it is proper or not. Also, verify the same in STAS configuration.

    3. Verify AD server local Firewall and if it is enabled/disabled, please bypass USP ports 6060, 6677, 5566 from advance firewall in AD server.

    4. Verify tcpdump on XG telnet console with port 6060 or port 6677 and see whether any incoming/outgoing packets.

    5. Verify Log Viewer -> Authentication logs, for the users if it is getting failed because of any reason or log itself not generated.

    Please, send screen-shots for further verification.

Reply
  • 0 in reply to DeepakPatidar

    Hi Deepak,

    Please, follow below steps for further troubleshooting:

    1. Verify if AD server IP is correct in XG telnet console. Also, cross verify in AD server with XG IP address.

    2. Verify DN name in AD integration if it is proper or not. Also, verify the same in STAS configuration.

    3. Verify AD server local Firewall and if it is enabled/disabled, please bypass USP ports 6060, 6677, 5566 from advance firewall in AD server.

    4. Verify tcpdump on XG telnet console with port 6060 or port 6677 and see whether any incoming/outgoing packets.

    5. Verify Log Viewer -> Authentication logs, for the users if it is getting failed because of any reason or log itself not generated.

    Please, send screen-shots for further verification.

Children