Communication between DC's with STAS for SSO... NEED HELP!

What i would do is to start troubleshooting by trying to disable the windows firewall on the server first to rule out the windows firewall being a problem.

Then test authentication settings on the xg, is the stas service running on the dcs?  Try running services with the domain administrator account.

I would work on getting stas up on the primary dc first to get stuff going then go set the secondary stas if they are not running at all.

Can you verify importing active directory groups in the xg?  That might give you another clue maybe the fqdn isn't set correctly.

Try stas transparent mode that worked when i set it up the first time.

Good luck!

Thank you for the reply.

The odd thing is almost everything is working just as it should.  I was able to Connect to my 2 DC's with Sophos XG (no problem).  Import Users/Groups (no problem).  Setup STAS (no problem).  Everything seems to work just fine... BUT.  It drops my Workstations off of the "Live Connections" every few minutes. (BIG PROBLEM)

Things I have tried:

-Using Domain Administrator account for setting up Sophos SSO and STAS Suite.  (Didn't seem to help)

-Disabling ALL "Logoff Detection Settings"... this seems to work, for it stops DROPPING my workstations every few minutes, but it is also NOT advised by SOPHOS.  Per: Sophos Article: Sophos Firewall: Clientless Single Sign-On in a Single Active Directory Domain Controller Environment
"Ensure Logoff Detection and Dead Entry Timeout are not simultaneously disabled because users will remain live in the STAS DB."

Just another update:

Like B.R.O mentioned above, today I figured I would try just 1 DC and see if I could get that connection working.  So I unchecked my 2nd DC in "Authentication Server List" and also removed it from the STAS "Collector" list.  So my setup was just 1 DC with STAS SUITE loaded.

SAME EXACT ISSUE... I would be able to get authenticated as soon as the workstion logged onto the network, and all was good, but after a few minutes... it fell off the "Live Connections" list and the workstation would not longer have Internet access.

NOTE: I was using the setting on DC STAS SUITE: "Enable Logoff Detection" PING.

NOTE 2: Just to try, I again disabled ALL "LOGOFF Detection Settings"... my workstation would then remain able to access the Internet.  (BUT) I did notice it would fall off the "Live Connections" within minutes, but as soon as I would initiate Internet active on the Workstation again, it would re-show back on the list of "live connections".  So whatever is removing my Workstations every few minutes, seems to be less bothered when there is NO "Logoff Detection" set on the DC.  But I also know this is not an advised setup.

I am really starting to think I should maybe think about another authentication method.  I just hate to load the Client, for I noticed it requires Java on every workstation.  Something I would rather not have to load on all my workstations (mainly due to security issues with Java often).

Still open to ideas???? :-)

Thanks

INFO:  I think I have been looking in the wrong area for the fix to my dropped users.  All focus has been on my DC’s and the STAS Suite they run.  BUT here are some observations I have been making the last few days since I am STILL trying to get this unit ready for production! L

Lately the focus has been on possible communication issues between my 2 DC’s and the SUITE/Agent roles… thinking that something was causing the users to get dropped minutes after being “Authenticated” w/ clientless SSO. (Users fall off of “Live Connections” within minutes:  BUT as I show below, I am starting to doubt this is my problem area:

Observations:

1. SETUP: Loaded STAS SUITE on only 1 DC. 
   1. Only the 1 DC listed as a “Authentication Server” (on XG box)
   2. Only the 1 DC listed on “Authentication Server List” (on XG box)
   3. Only the 1 DC listed as “Collector” on STAS tab (on XG box)
   4. “Enabled Logoff Detection: PING”

Result:  EXACT SAME… users would get authenticated… then minutes later (even with Internet open to MSN page) would be dropped off the “Live Connections” List… replaced with either NA or nothing.  On the workstation, Internet access would stop and I would be presented with the “Network Authentication” page.    I would then have to “Lock” the workstation or “logoff” and back on in order to reestablish the workstation under “Live Connections”, and resume Internet connectivity on workstation.  Only to have this happen again a few minutes later.

2. SETUP #2: -Disable “Enable Logoff Detection”- (On DC STAS Suite)

RESULTS: As stated many times before, IF I DISABLE ALL “logoff Detection” settings on the STAS Suite (on DC) my test workstations would STILL fall off the “Live Connections” list (on XG) within a few minutes, BUT as soon as I would click a link, or do anything on the workstation to initiate Internet activity… the workstation would show back up on the “Live Connections” list.

3. SETUP #3: –Captive Portal-
   1. I wanted to see if “Live Connections” would DROP off my workstations if I tired a completely different Authentication method. SO I signed my test workstations in w/ Captive Portal logon screen

Results:  JUST like above, the workstations would show up under “Live Connections” and after a few minutes (with browsers open to CNN) the would be removed from “Live Connections”… BUT if I would initiate browrser activity again (click on something new) they would again show back up under “Live Connections”.

My NON-EDUCATED guess:  It seems I have been looking in the WRONG place for this fix.  I think my STAS SUITE is working correctly(though it may need a few tweeks), for when “Enable Logoff Detection” is enabled it is monitoring the XG “Live Connections” for workstations that are not longer “Active”… and DUE to the XG box dropping users off of “Live Connections” every few minutes, it does see my workstations as NOT ACTIVE and drops the workstation off of it’s “Live Users” (requiring the workstation to re-authenticate with the AD server.

So my problem (SEEMS TO ME) to be with the XG box dropping my workstations every few minutes off of “Live Connections”.  For it seems to do this no matter what authentication I use (SSO or Captive Portal)?

Question to anyone who can verify:

1. Do your users appear and disappear (fall off) of the “Live Connections” every few minutes, or do they stay on this list until they SHOULD be removed due to inactivity or whatever “User Inactivity” you setup?

Thanks for help trouble shooting this...

P.S. Call out to Sophos Tech support... I have updated my case over 2 days ago, but still have not heard ANYTHING?  I am going to again update my case with these new findings.

INFO:  I think I have been looking in the wrong area for the fix to my dropped users.  All focus has been on my DC’s and the STAS Suite they run.  BUT here are some observations I have been making the last few days since I am STILL trying to get this unit ready for production! L

Lately the focus has been on possible communication issues between my 2 DC’s and the SUITE/Agent roles… thinking that something was causing the users to get dropped minutes after being “Authenticated” w/ clientless SSO. (Users fall off of “Live Connections” within minutes:  BUT as I show below, I am starting to doubt this is my problem area:

Observations:

1. SETUP: Loaded STAS SUITE on only 1 DC. 
   1. Only the 1 DC listed as a “Authentication Server” (on XG box)
   2. Only the 1 DC listed on “Authentication Server List” (on XG box)
   3. Only the 1 DC listed as “Collector” on STAS tab (on XG box)
   4. “Enabled Logoff Detection: PING”

Result:  EXACT SAME… users would get authenticated… then minutes later (even with Internet open to MSN page) would be dropped off the “Live Connections” List… replaced with either NA or nothing.  On the workstation, Internet access would stop and I would be presented with the “Network Authentication” page.    I would then have to “Lock” the workstation or “logoff” and back on in order to reestablish the workstation under “Live Connections”, and resume Internet connectivity on workstation.  Only to have this happen again a few minutes later.

2. SETUP #2: -Disable “Enable Logoff Detection”- (On DC STAS Suite)

RESULTS: As stated many times before, IF I DISABLE ALL “logoff Detection” settings on the STAS Suite (on DC) my test workstations would STILL fall off the “Live Connections” list (on XG) within a few minutes, BUT as soon as I would click a link, or do anything on the workstation to initiate Internet activity… the workstation would show back up on the “Live Connections” list.

3. SETUP #3: –Captive Portal-
   1. I wanted to see if “Live Connections” would DROP off my workstations if I tired a completely different Authentication method. SO I signed my test workstations in w/ Captive Portal logon screen

Results:  JUST like above, the workstations would show up under “Live Connections” and after a few minutes (with browsers open to CNN) the would be removed from “Live Connections”… BUT if I would initiate browrser activity again (click on something new) they would again show back up under “Live Connections”.

My NON-EDUCATED guess:  It seems I have been looking in the WRONG place for this fix.  I think my STAS SUITE is working correctly(though it may need a few tweeks), for when “Enable Logoff Detection” is enabled it is monitoring the XG “Live Connections” for workstations that are not longer “Active”… and DUE to the XG box dropping users off of “Live Connections” every few minutes, it does see my workstations as NOT ACTIVE and drops the workstation off of it’s “Live Users” (requiring the workstation to re-authenticate with the AD server.

So my problem (SEEMS TO ME) to be with the XG box dropping my workstations every few minutes off of “Live Connections”.  For it seems to do this no matter what authentication I use (SSO or Captive Portal)?

Question to anyone who can verify:

1. Do your users appear and disappear (fall off) of the “Live Connections” every few minutes, or do they stay on this list until they SHOULD be removed due to inactivity or whatever “User Inactivity” you setup?

Thanks for help trouble shooting this...

P.S. Call out to Sophos Tech support... I have updated my case over 2 days ago, but still have not heard ANYTHING?  I am going to again update my case with these new findings.

Just wanted to post a follow up...

After WAY to long working on this... it turned out to be the DUMBEST issue.

IF, I would have noticed sooner, PING was an issue between my DC's and my test machines.  They would join the domain just fine, but due to a DNS issue (I do believe) they were not getting registered correctly.  Causing a issue where the were not able to be PINGED from the DC.  They could ping the DC, but the DC could not ping them.

SO... IF you are having this issue... PLEASE double check you can ping BOTH directions and double check SIMPLE network setup.

THANKS all who helped and gave tips!  ALWAYS appreciated!

Till next time!  See ya!