Smoothwall and AD

[Mako]

Morning,

 

I'm not sure whether to put this here or in the Smoothwall forum, but at the moment I suspect it's a server issue around AD or DNS.

 

Yesterday morning the Smoothwall suddenly decided to stop playing ball with AD (edit: not pointing the blame, the server may have fallen out with the smoothwall). I have done no configuration changes to the server or network prior to this happening, and no updates were installed prior to this happening. Everyone was browsing the internet fine and then out of nowhere, no one can authenticate and endless proxy auth pop-ups.

 

An update has been subsequently installed, as one of the things I have tried is turning the DC's off and on again (which forced one of them to update and install KB4523205).

 

The issue sounds very familiar to the one here : http://www.edugeek.net/forums/internet-related-filtering-firewall/168921-smoothwall-not-connecting-ad-after-windows-updates.html

 

However the reg key in question was already set to 2 so that ruled that out.

I have tried:

Rejoining the smoothwall to the domain. It joins fine (although interestingly the diagnostic isn't happy about the Kerberos keytab).

Restarting DC's

Deleting the AD config in the smoothwall and completely starting from scratch (it can successfully poll AD and bring in the groups)

Checked DC's for DNS issues, can't find any

Re-routed the Smoothwall to a different switch

Nothing dodgy is appearing in the Security/System/DNS logs on the DCs

Edit: Checked the time between Smoothwall and DCs, it's in sync.

 

What baffles me is that every time I run an AD diagnostic on the smoothwall I get a different result. I've attached some pics. It did actually pass the test with flying colours this morning, but then when more than 30 users started logging in, it threw a wobbly again.

 

To confuse matters more I have a remote site that uses the same domain, there's an remote smoothwall there and it's configured to use our on-site PDC as a backup and it can contact all DC's perfectly. It's just the on-site setup here that's fallen over.

 

Network is working fine. No users are having issues around file shares, logging in or using the system. Edit: Addiitonal info: PDC is 2019, secondary DC is 2016.

 

I'm hoping that someone can just say "Oh, it's this" and put me out of my misery.

Edited November 27, 2019 by Mako

[ShellfishClive]

Whats the load like on the Smoothwall? We currently have a cluster setup and when the load is high the Auth boxes pop up.

[RichWildWolf]

Have you got the correct authentication policies and in the correct order?

 

Use this page to find out what each option means to correctly setup your polices.

 

When you change these make sure you click the restart proxy button that appears in the top and wait a few minutes.

[Mako]

Thanks for the responses.

 

After further digging and some help from Smoothwall support, turns out the WSUS server was being logged against the smoothwall and overloading the logging and filtering when machines were trying to download updates. The load averages were punching past 20 and it couldn't cope. No idea why this started happening now, as the new WSUS server was part of the Summer project in upgrading all the servers.

 

Have entered the WSUS server as an auth bypass and disabled the logs to alleviate the problem.

[WorksOnMyPC]

I had issues with smoothwall and multiple domains where users would be unauthentic and set as default depending on how it felt.

 

What is your authentication method in Web Proxy > Authentication > Manage Polices for the proxy IP and port you are using? Is it NTLM or Negotiate?

 

Also check Authentication Service logs in the log area for any weird domain issues and Services > Authentication > User Activity to see if any users are authenticating and which method.

 

I wish you all the luck in the world while you are in the depths of smoothwall!

[John_P]

I think I am having a similar problem with my WSUS server and Smoothwall. Which logs did you disable?