Sophos UTM Authentication Problem

[rrrrr]

Came in this morning and users were reporting "Access Denied Authentication Failed" messages. All was fine when I went home on Friday.

Been speaking to Sophos tech support but getting nowhere fast and feel like I'm telling them more than they are telling me!

 

My understanding is that the authentication is a chain of 3. Client Computer sends Kerberos key for users login credentials > UTM checks these against AD > AD server

 

My 1st checks were between UTM and server

1, Restart UTM

2, Re-join UTM to domain under single sign-on tab (successful)

3, Goto Authentication servers, select DC's and do an "Authenticate example user" test (successful)

4, check the user is being filtered correctly in web protection>policy help desk (all correct)

5, flush authentication cache

6, One thing I did notice was our webfiltering authentication mode is set to transparent (no username or password box prompt) but our default authentication was set to none. I have since changed this to Active Directory SSO but still no luck. can anyone confirm what this should be as I hadn't changed it and it was set to none?

~

 

My Next checks were between Computer and UTM

1, Check proxy settings. (All correct and the authentication error would not appear if computer could not contact UTM, it would be page cannot be displayed)

2, check UTM logs for the machine

 

2015:08:24-11:32:35 proxy01-2 httpproxy[6376]: id="0003" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="192.168.3.7" dstip="" user="" ad_domain="" statuscode="407" cached="0" profile="REF_HttProContaManagLan3 (AD auth Computers)" filteraction=" ()" size="0" request="0xe5742000" url="http://kzufjwvz/" referer="" error="" authtime="130" dnstime="0" cattime="0" avscantime="0" fullreqtime="200" device="0" auth="2" ua="Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36" exceptions=""

 

The user and domain parts are blank so the UTM is not receiving these from the machine.

 

3, restarted machine, no luck

4, run klist purge, no luck

 

any ideas?

[Blue_Cookeh]

You might want to check the Sophos time matches your domain time. Also I think there's an issue with SSO on a transparent proxy if the first site they hit is HTTPS but I'm not sure if that problem still exists.

 

Default authentication is only used as a fallback when your filtering profiles don't require it.

Edited August 25, 2015 by Blue_Cookeh