This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Kerberos SSO fails after Active>Passive failover

We are using a pair of vmware Sophos UTMs (with E1000 drivers). Using standard mode with SSO and a FQDN in the client proxy settings (should be using kerberos) and joined to the domain.
When we have a failover event to the Slave UTM, all web filtering kerberos fails with a sophos branded authentication failed web message. If we switch the clients to NTLM by using an IP - it all works again. After some time varying between 5-20 mins everything begins working again.

Any ideas?

Kind Regards,
James

This thread was automatically locked due to age.

Parents

0 BAlfson over 11 years ago

Hi, James, and welcome to the User BB!

You didn't say how long you've had this setup or your exact version - 9.105-9 on ESXi 5.1?

I googled site:astaro.org virtual mac and the first result was https://community.sophos.com/products/unified-threat-management/astaroorg/f/53/t/34096. Any luck with that?

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 ashridge over 11 years ago in reply to BAlfson

Hi Bob,

Many Thanks - I had read that one - but the thread seemed to indicate it was fixed in an earlier version - we are 9.105-9 on ESXi 5.1U1

James
Cancel
Vote Up 0 Vote Down

Cancel
0 ashridge over 11 years ago in reply to ashridge

To update the thread, it turned out to be a time skew issues caused by the vm host during the utm reboot - we now have the following error:

2013:09:19-13:39:15 utm-1 httpproxy[5954]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xcf06350" function="adir_auth_process_negotiate" file="auth_adir.c" line="1108" message="gss_accept_sec_context: Key table entry not found"

Which seems like it may link into some weird uppercase client issues here?
https://community.sophos.com/products/unified-threat-management/astaroorg/f/55/t/44463
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 ashridge over 11 years ago in reply to ashridge

To update the thread, it turned out to be a time skew issues caused by the vm host during the utm reboot - we now have the following error:

2013:09:19-13:39:15 utm-1 httpproxy[5954]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0xcf06350" function="adir_auth_process_negotiate" file="auth_adir.c" line="1108" message="gss_accept_sec_context: Key table entry not found"

Which seems like it may link into some weird uppercase client issues here?
https://community.sophos.com/products/unified-threat-management/astaroorg/f/55/t/44463
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data