AD integration with xg firewall

Nisar...

How many Domain Controllers do you have on site with the XG?

Hey, 

you can use the Windows logon to authetificate the USers. 

have a look at: 

https://community.sophos.com/kb/en-us/123156

Aside from STAS, if it is just for web browsing you could use NTLM authentication, which will fall back to captive portal if it fails.

STAS authenticates your computer regardless of traffic.

NTLM is a web traffic authentication method, though after authentication the user is applied to all traffic types from that IP.

Under Authentication, Services, make sure that the Firewall Authentication Methods includes your server.

Under Administration, Device Access, turn on NTLM for the zones you want to enable.

This brings me to a Question I just had in my Lab. If I configure AD SSO using NTLM,  my Users on my XG Firewall (Which are Synchronized from ActiveDirectory) are looking like the following: benutzername.

Users coming from NTLM are looking like benutzername@mydomain.local. XG Firewall does not recognize that benutzername and benutzername@mydomain.local are the same User.

Is there any workarround known for this? In UTM's world we had to join Firewall to the Active Directory, so it knows that this user belongs to it's domain. In XG we do not have the possibility to join the Firewall with AD if I'm right?

Hello, 

do you have add the AD Server to ... Configure -> Authentication -> Services ? 

Here you can add the priority of the login Server. 

Thanks for this input. Yes I did already set the Precedence of Active Directory under "Firewall Authentication Methods" to the top. It didn't change anything to my behavior.

HuberChristian said:

Users coming from NTLM are looking like benutzername@mydomain.local. XG Firewall does not recognize that benutzername and benutzername@mydomain.local are the same User.

Is this just a logging/reporting problem, or are you not getting the correct firewall rule or web policy applied?

AFAIK, the rules should be applied correctly regardless of how the naming looks like.

Under Authentication \ Users do you have one user or two?

HuberChristian said:

Users coming from NTLM are looking like benutzername@mydomain.local. XG Firewall does not recognize that benutzername and benutzername@mydomain.local are the same User.

Is this just a logging/reporting problem, or are you not getting the correct firewall rule or web policy applied?

AFAIK, the rules should be applied correctly regardless of how the naming looks like.

Under Authentication \ Users do you have one user or two?

Michael Dunn said:

Under Authentication \ Users do you have one user or two?

I have two users. The one from the AD, and the one created by NTLM.