Hi, I've a XG 105 Firewall. Whenever I try to turn on "Match Known Users" option in the Firewall rule, it blocks Internet Access for all users. My configuration: ISP Modem >> XG 105 as the only gateway User Authentication via Active Directory (AD) All users from AD have been populated in the Firewall (used the Captive Portal to get users from AD to Firewall) Two groups of users and members are added to each group Two corresponding Firewall rules for both rules, I've selected: "Match Known Users" and selected "Show captive portal to unknown users" Selected respective group under "user / group". Whenever I do that (select Match Known Users), Internet access to users get blocked! I attach a screenshot of the rule here for your reference! Greatly appreciate any suggestion / ideas! Thank you!

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Issues with Match Known Users option in XG 105

Hi,

I've a XG 105 Firewall. Whenever I try to turn on "Match Known Users" option in the Firewall rule, it blocks Internet Access for all users. My configuration:

ISP Modem >> XG 105 as the only gateway
User Authentication via Active Directory (AD)
All users from AD have been populated in the Firewall (used the Captive Portal to get users from AD to Firewall)
Two groups of users and members are added to each group
Two corresponding Firewall rules
- for both rules, I've selected:
  - "Match Known Users" and selected "Show captive portal to unknown users"
  - Selected respective group under "user / group".
Whenever I do that (select Match Known Users), Internet access to users get blocked!

I attach a screenshot of the rule here for your reference! Greatly appreciate any suggestion / ideas! Thank you!

This thread was automatically locked due to age.

0 rfcat_vk over 7 years ago

Hi,

to me that would indicate a possible name mismatch.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Aneesh Kuniyil over 7 years ago in reply to rfcat_vk

Hi @rfcat_vk,

Thanks for the reply! Do you mean that the name for the Web Policy (Web >> Policies >> Normal_User_Group) and the User Group (Authentication >> Groups >> Normal Internet Access) must be the same?

-aneesh
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 7 years ago in reply to Aneesh Kuniyil

Hi aneesh,

I would have thought so, otherwise how could one relate to the other.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Aneesh Kuniyil over 7 years ago in reply to rfcat_vk
Hi Ian,

Thank you! That's interesting! I tried that with a new rule and it seems to work.

I created:

a new web policy

a new user group with the same name as the web policy

a new firewall rule and added that web policy

checked "Match known users" and to show captive portal

tested with one user and it is working perfectly, just that the Captive portal doesn't show automatically even though it is set to show. I authenticated by accessing Captive portal directly via it's URL.

However, when I try the same with the existing rule which I've the issue, it doesn't seem to work. I'm waiting for the break time and planning to create a new rule and test. If it works, I will delete the current rule with the issue.

I will keep you updated here! Thank you! :)

-aneesh
Cancel
Vote Up 0 Vote Down

Cancel
0 Aneesh Kuniyil over 7 years ago in reply to Aneesh Kuniyil

Hi Ian,

The issue still hasn't been solved. I tried most things I could, it just doesn't seem to work! I've been insanely busy with some issues related another two Firewalls - XG330 - for the past couple of days ! :(

I've two more XG105 Firewalls to configure, I hope this problem won't come for that!

If you guys find any other solution to this, please post! Thank you!

-aneesh
Cancel
Vote Up 0 Vote Down

Cancel
0 Jelle over 7 years ago in reply to Aneesh Kuniyil

How do users authenticate? Via the portal? Or do you have STAS running? Or is the authentication client installed on each computer? Or via proxy?
Cancel
Vote Up 0 Vote Down

Cancel
0 Aneesh Kuniyil over 7 years ago in reply to Jelle

Hi Jelle,

Users are authenticated via Captive Portal. No STAS running.

All users also have Sophos Endpoint installed.

Thanks.

-aneesh
Cancel
Vote Up 0 Vote Down

Cancel