Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 2 replies
  • Subscribers 2 subscribers
  • Views 13579 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL-VPN local user authentication failes if connected to AD

ipzipzap
Hi,

my UTM is connected to an Active Directory. In my SSL-VPN config I added the group "Active Directory Users" so that every user can connect via VPN. This is working great without any issues.

Now I needed a VPN-User who shouldn't get any AD-Access, only VPN to get access to an internal webserver. So I created a local user on the UTM and added him to the user list in my VPN profile.

Now everytime I want to connect with this user via VPN I will get an "authentication failed" error.

Here are the parts of the VPN-Log:
2015:05:05-14:41:19 gw01 openvpn[19957]: 91.118.***.***:62540 TLS: Username/Password authentication deferred for username '***' [CN SET]
...
2015:05:05-14:41:21 gw01 openvpn[19957]: 91.118.***.***:62540 SENT CONTROL [esc]: 'AUTH_FAILED' (status=1) 



And here for the authentication deamon log:
2015:05:05-14:41:19 gw01 aua[26415]: id="3006" severity="info" sys="System" sub="auth" name="Trying 192.168.0.111 (adirectory)"
2015:05:05-14:41:19 gw01 aua[26415]: id="3005" severity="warn" sys="System" sub="auth" name="Authentication failed" srcip="91.118.***.***" host="" user="***" caller="openvpn" reason="DENIED"



Why can't I use my local user for authentication? It seems that the UTM asks the AD first, and when the authentication is denied, because there is no such user in the AD, it won't look any further in the local user database.


Any help would be greatly appreciated.

Dino


This thread was automatically locked due to age.
  • 0
    Dino, it just doesn't work that way, and you will want to delete the Local user object.  You might want to check your configuration against HTTP-S Proxy Access with AD-SSO.  I would have different AD Security Groups for VPN and Web Filtering.  Check #6 in Rulz to see that you need to have VPN users synced from AD.  I typically configure Prefetch for the VPN users at the bottom of the 'Advanced' tab in 'Definitions & Users >> Authentication Services'.

    Users should not be synced for Web Filtering access, just use the Backend Group that refers to the AD Security Group allowed Web Access.  I typically configure three such groups, "Open Access," "Restricted Access" and "No Web Access" and then assign different Web Filtering Policies to each.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0

    Hi Dino,

     

    Did you ever get a fix for this as I'm having the same problem ?

     

    Regards,

     

    Nick

Unfiltered HTML