pixellip Posted November 24, 2017 Posted November 24, 2017 Hi everyone Is anyone here using Sophos UTM and macs please? We have an issue here we can't resolve and it would be helpful if someone else is using this with macs. Thanks
CHSGM Posted November 26, 2017 Posted November 26, 2017 I know of one issue we have identified within the last year - may or may not be relevant for yourself. With machines on the domain and operating wirelessly, the UTM can no longer authenticate due to MacOS 10.9 and beyond implementing the Captive Portal feature. In order to eliminate this, we either had to resort to ensuring there was a wired connection, or removing the wi-if helper tool entirely from the machine.
jamesp Posted November 28, 2017 Posted November 28, 2017 Hi everyone Is anyone here using Sophos UTM and macs please? We have an issue here we can't resolve and it would be helpful if someone else is using this with macs. Thanks Bit more info please When you state resolve - are you talking dns resolution ? Here to help - just feed us more info!
pixellip Posted November 28, 2017 Author Posted November 28, 2017 Thanks for trying to help me. We have an on going problem about this that is causing everyone lots of headaches.........it's very annoying. It seems that when people are signed into the UTM on the macs via the UTM client, after a period the macs seem to 'sign out'. The UTM client looks like it is signed in (not being greyed out).......but if you go to any https site Google Chrome reports NT CERT INVALID an attacker might be trying to steal your information ....if you refresh the page the page then loads. This can be happening an awful lot in the day. It means if people are signed into Microsoft Outlook Web Access (or any site ) they end up losing their work. Also in Media, the pupils might be uploading videos to youtube ( via the web browser ) and they walk away........come back and the video upload has hung ( yet the client is still signed in ). So this is causing lots of problems. Before we used browser based authentication but this caused issues ( you have to keep the tab open and allow pop ups) ). People kept on closing the authentication tab that was open ( and people were complaining ) so we moved over to the UTM Client. This problem means that people are having to keep opening new tabs in Chrome then refreshing the page - whilst it doesn't sound like much it's highly annoying for the users. If this issue happens we suggest going to http://www.bbc.co.uk then it seems to load that page and allow them to carry on. The trouble is exorted .mov Final Cut videos hanging when uploading to Youtube is not acceptable. I've tried it from both Final Cut and Directly to youtube in the browser and it seems to fall over.......not always. Our PCS give us no issues at all with the UTM. This issue has been occurring on both AD joined macs and standalone macs. Our DNS is set to our DNS Server/Domain controller. The Sophos UTM client certificate is set to Trusted in System and also I copied it to Users/Shared on the macs. One thing someone has tried is to run a page refresher which one person has reported 'has stopped him signing out of the internet'. I am not convinced the client is actually signing out of the internet as it is not greyed out but purple. This problem is happening around the school. I have spoken to Sophos and they suggested running Wireshark to capture on port 9980 but invariably I start it off then come back at the end of the day and it has crashed or not captured. Very frustrating. Sophos are trying to ascertain at what time does this occur vs looking at the log files. We use Mavericks on a lot of Macs and El Capitan on the more recent ones. I've noticed up in Art when searching in Safari sometimes you get the 'this website is not secure' message about google or the bbc.........so it happens up there.... So to sum up, when the page stops they refresh it and it then loads the page - it seems to be only for https sites........it happens in Safari and Chrome on different macs...... We are using Sophos UTM client 1.50 ( I can't see an update to this ). Sophos say none of their other customers are experiencing this issue ( to their knowledge ) . We have updated the UTM firewall to the latest version but alas this made no difference. One thing I noticed was in Media Studies I set the macs not lock the screen with a password after 5 minutes as I noticed this was causing it to drop the internet when they got back to their desks if they were to pop out. Maybe there is a setting in the Firewall somewhere that causes this timeout? We've been looking everywhere but can't spot it. Thanks ( and sorry for such a long post!)
jamesp Posted November 28, 2017 Posted November 28, 2017 Smells like a user inactivity timeout to me - could you confirm what your settings here, are you not using STAS at all?
pixellip Posted November 28, 2017 Author Posted November 28, 2017 What is Stas please James? ( The fact I am asking means we are probably not using it!) Which settings are you after ......... Thanks for trying to help - I really appreciate it!
pixellip Posted November 28, 2017 Author Posted November 28, 2017 I just checked the firewall.......STAS is greyed out so we are not using it ( so it seems )
pixellip Posted November 28, 2017 Author Posted November 28, 2017 Apologies if it requires a long winded answer ....I will try to find out and have a read on it. It wasn't me who set the UTM up but I don't think they have touched STAS from looking at it ( and Sophos haven't mentioned it)
pixellip Posted November 28, 2017 Author Posted November 28, 2017 Hi James..............sorry to ask this ( as we have been discussing it ) - can you simply explain why we need to turn STAS on and for what purpose ( in regard to the Macs )......we are logged into Activ Directory, single sign on ......so what is STAS and why do we need it? Thanks for your help.
jamesp Posted November 29, 2017 Posted November 29, 2017 Morning! Pre coffee so excuse the typo's! If your using SSO then you should be ok, the reason that i asked about STAS is that this component has a config for User inactivity - though pure SSO does not, narrowing the issue somewhat. Here's a link to both configurations/setups so you can see technically how they both work: STAS https://community.sophos.com/kb/en-us/126939 SSO (AD) https://community.sophos.com/kb/en-us/120791 Please take a peek, let me know which your using/is set up. Kind regards James
pixellip Posted November 29, 2017 Author Posted November 29, 2017 (edited) Ah no problem and thanks for your persistence in helping me. We started reading about STAS but said why do we need this as not all the macs are not bound to AD...........we are using SSO Transparent mode ( and the UTM client for macs ). They are still logging into the UTM client with their AD credentials... It is interesting if we set up a page refresh site to refresh Chrome every 30 seconds people tell me the problem doesn't bother them so much..........so we have a way around for now.......but still need to solve it. Edited November 29, 2017 by pixellip
jamesp Posted November 29, 2017 Posted November 29, 2017 (edited) That does not make any sense from a UTM perspective as there isn't anything that would be timing them out so to speak, leave this with me for a bit and I'll have a good think! Out of interest - what AV do you use and are you using anything like Impero or similar? Edited November 29, 2017 by jamesp
pixellip Posted November 29, 2017 Author Posted November 29, 2017 Thank you James............I really appreciate it. It has been going on for months here with no resolve and lots of very frustrated mac users. Mike
HereIGoAgain2601 Posted November 29, 2017 Posted November 29, 2017 Can’t be of much help but we have Macs connecting using AD SSO to a Sophos UTM. No need for a client and works well
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now