User identification in reports etc.

Hi David,

Try this, Report | Custom | Custom Web Report. Check out the screenshot.

Any help?

Hi Sachin, thanks for your response.

When i do that this is the report i get showing user names as Unidentified.

On our older system that was a Sophos Web Appliance and Endpoint protection, I believe it was the endpoint protection that was telling the appliance who the user was. Now we have cloud endpoint and the XG UTM it appears to not know who people are.

Please show me the inside configuration of the Policy Rule 16. Maybe, that is an unauthenticated traffic. Alongside, make a search query by explicitly defining a username in the Username field of the custom report page. What is the result?

Cheers

This is the 2nd part of the rule (let me know if you need to see the top part of the screen). This is the rule the installing engineer setup for most web traffic.

In the rule, the "Match known users" option is not selected so that becomes a general rule to forward the traffic. I am curious to learn which authentication type is configured in the XG and how does the User authenticate?

Cheers

I believe this is our problem, we don't have anything other than Sophos Cloud Endpoint on the computers to identify them and i dont believe it uses that on the XG to identify the users, unlike how our old Web Appliance did.

What options do we have to enable user authentication? If there is a method that automatically uses the users domain login credentials without them entering any login details that would be good.

Follow 3 steps, Go to:

1. Administration | Device Access | select Captive portal for the required zone.
2. Authentication | Services | Firewall Authentication Services | Select the AD host definition on TOP.
3. Select "Match known Users" in the Firewall Rule that forwards the internet traffic.

Hope that helps.

Thanks for that, it now makes more sense to me.

I have tried that and it appears to work after i install the Sophos Client Authentication software and login on my PC, so i guess we now have to install that on all computers for this to work properly.