Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 1 subscriber
  • Views 3922 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN and AD-users

SIKN
Hello

I would like to change our VPN from locally authenticated users to Active Directory-user.
The problem is, it's not working.

I have done the following things: 
- created a new OU in the AD with the VPN users (not the same like for the AD-Auth)
- created a new group which includes the new users in the new vpn-ou.
- added a new dynamic membership group in the UTM which points to the new group in the AD
- the new group in the UTM added to the VPN-allowed user

problem: 
2015:02:24-12:45:28 utm-1 aua[25153]: id="3006" severity="info" sys="System" sub="auth" name="Trying xx.xx.xx.xx (adirectory)"

2015:02:24-12:45:29 utm-1 aua[25153]: id="3005" severity="warn" sys="System" sub="auth" name="Authentication failed" srcip="xx.xx.xx.xx" host="" user="new_vpnusername" caller="portal" reason="DENIED"


When I create a new user in the UTM and add remote auth, then it's working. But I would like to synch this with the AD. So i only have to download and deploy the vpn-config for the user.

UTM:
ASG-425 HA Pair
Firmware version: 9.308-16

Has someone a good idea?


This thread was automatically locked due to age.
Parents
  • 0
    Hi,

    On the 'Advanced' tab of 'Authentication Services', open the prefetch live log and prefetch the AD Security group containing the users that should have access to the SSL VPN. You will see in the Live Log that some users aren't fetched because of a conflict with Local user objects.  This will give you a list of the Local Users you will want to delete.  I suggest that you also delete the Certificate that was created by Web Admin for each user.  Refer to #6 in Rulz for perspective on what users you want to sync.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0
    Hi,

    On the 'Advanced' tab of 'Authentication Services', open the prefetch live log and prefetch the AD Security group containing the users that should have access to the SSL VPN. You will see in the Live Log that some users aren't fetched because of a conflict with Local user objects.  This will give you a list of the Local Users you will want to delete.  I suggest that you also delete the Certificate that was created by Web Admin for each user.  Refer to #6 in Rulz for perspective on what users you want to sync.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data
Unfiltered HTML