Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 11 replies
  • Subscribers 1 subscriber
  • Views 4831 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Remote AD SSO keeps failing

cthorpe
I'm having AD SSO issues where our new Sophos 120 units at our branch offices in NY and FLA keep disconnecting from our primary AD server in AZ and because of that, our users there are getting pop-ups for authentication.  To resolve this issue I had to re-join the domain and it'll work for 3 to 4 hours and then it breaks again.

We have Win2008 R2 RODC servers at both locations under one domain name.

The Sophos units are all connected via Site to Site VPN (IPSEC - AES256). MTU Discovery is checked at all remote gateways.

We have an older Astaro 320 here at the main office in AZ.  All units are on 8.306 (Can't wait for v9 to come out)

The web filter log shows this when users can not authenticate: (this log also appears on the FLA unit as well)

AD SSO works well at the AZ site and I'm guessing there might be some tweaking that needs to be done on the VPN side?

2012:09:13-17:02:23 ny01-proxy httpproxy[6205]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x9d432f8" function="auth_adir_auth_crap_callback" file="auth_adir.c" line="888" message="Authorization denied (NT_STATUS_NO_TRUST_SAM_ACCOUNT)"
2012:09:13-17:02:23 ny01-proxy httpproxy[6205]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.1.252" dstip="" user="Administrator" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4593" request="0x9d432f8" url="www.yahoo.com/" exceptions="" error=""
2012:09:13-17:03:02 ny01-proxy httpproxy[6205]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x9d432f8" function="auth_adir_auth_crap_callback" file="auth_adir.c" line="888" message="Authorization denied (NT_STATUS_NO_TRUST_SAM_ACCOUNT)"
2012:09:13-17:03:02 ny01-proxy httpproxy[6205]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.1.252" dstip="" user="administrator" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4593" request="0x9d432f8" url="www.yahoo.com/" exceptions="" error=""
2012:09:13-17:05:37 ny01-proxy httpproxy[6205]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x9d43898" function="auth_adir_auth_crap_callback" file="auth_adir.c" line="888" message="Authorization denied (NT_STATUS_NO_TRUST_SAM_ACCOUNT)"
2012:09:13-17:05:37 ny01-proxy httpproxy[6205]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.1.252" dstip="" user="cthorpe" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4593" request="0x9d43898" url="www.yahoo.com/" exceptions="" error=""
2012:09:13-17:05:44 ny01-proxy httpproxy[6205]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x9d43e38" function="auth_adir_auth_crap_callback" file="auth_adir.c" line="888" message="Authorization denied (NT_STATUS_NO_TRUST_SAM_ACCOUNT)"
2012:09:13-17:05:44 ny01-proxy httpproxy[6205]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="CONNECT" srcip="192.168.1.252" dstip="" user="Administrator" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4612" request="0x9d43e38" url="versioncheck.addons.mozilla.org/" exceptions="" error=""
2012:09:13-17:05:44 ny01-proxy httpproxy[6205]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x9d47478" function="auth_adir_auth_crap_callback" file="auth_adir.c" line="888" message="Authorization denied (NT_STATUS_NO_TRUST_SAM_ACCOUNT)"
2012:09:13-17:05:44 ny01-proxy httpproxy[6205]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="CONNECT" srcip="192.168.1.252" dstip="" user="Administrator" statuscode="407" cached="0" profile="REF_HttProBlockUsersProfi (Blocked Users Profiles)" filteraction=" ()" size="4608" request="0x9d47478" url="services.addons.mozilla.org/" exceptions="" error=""


This thread was automatically locked due to age.
Parents
  • 0
    Change our WPAD file to point to their Astaro's FQDN instead of IP.  So far I have not seen or heard any issues from Florida (I'm testing the configurations there first) and if it all goes well, I will do the same for New York.

    I will post if anything changes.

    Again thank you for your responses.
Reply
  • 0
    Change our WPAD file to point to their Astaro's FQDN instead of IP.  So far I have not seen or heard any issues from Florida (I'm testing the configurations there first) and if it all goes well, I will do the same for New York.

    I will post if anything changes.

    Again thank you for your responses.
Children
No Data