Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 2 replies
  • Subscribers 26 subscribers
  • Views 6515 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

User Authentication in Proxy

M8ey

Hi all,

I recently purchased the XG230 for my work place and wanted to replace an old Squid proxy running Dans Guardian etc.

I read up and understand the XG230 can be used a proxy which I have configured fine. I have also connected this to my domain and selected the domain type for Authentication (Local moved to second place)

In AD I set up a Sophos-Users and Sophos-Elevated group and imported them into the XG230 - then set a FW policy to add certain restrictions to those groups - such as no Facebook, Youtube etc to the users but Ok for the Elevated.

I have my Mac and PC running through the new proxy however I am not prompted to authenticate.

Additionally the reporting on traffic is only reporting my IP addresses and not AD User.

I still haven't worked out how to get a report similar to Squid where it shows Username / Sites visited / download size / time.

At this point in time the XG230 is not being used as a Firewall and I am only using the proxy side until I change my network around.

How does the XG authenticate against AD and report specific users and hostnames of sites visited?

I cannot find it anywhere?



This thread was automatically locked due to age.
  • 0

    Ian,  

    XG uses stas suite to authenticate ad users. Make sure to follow the guides inside this link:

    There are kb to follow.

    Make sure to open the proper firewall rules. If everything is ok, you should see live users on control center counter increasing and inside the authentication log the username.

    If the firewall rule allows only users and it is the first matched, users will surf on internet and reporting will be fill up with usernames too.

    If something is wrong, users will not even able to surf on internet.

    Thanks

  • +1 in reply to lferrara

    Thanks for that.

    I will give it  blast today.

     

    I think I prefer the SG230 interface as its much less convoluted to set up.