Sophos XG and STAS

[geohanson]

Hi all,

 

We’ve been having issues with our Sophos XG430 and STAS.

 

We have 2 domain controllers (RM CC4) with STAS installed, however users get the captive portal popping up quite regularly which shouldn’t happen. It’s happening randomly to different PCs and different users with no pattern.

 

All the logon/logoff events look like they’re appearing correctly in the DC event viewers, and there’s no obvious difference between the Login/Logoff events from users which get successfully authenticated with STAS, and the users which see the captive portal.

 

Once signed into the captive portal, sometimes the internet will drop out after a few minutes and other times it will continue working. If I get disconnected, the logoff event appears in the XG Log, however there’s no corresponding logoff event in the event viewer on the DCs....

 

We have another domain on a separate IP range setup with STAS using the same XG430 and this works perfectly. We’ve never had a single instance of the captive portal and STAS seems to work without issue on this domain.

 

I’ve checked all the setting within STAS and everything looks correct.

 

I’m starting to struggle a bit with this one now!

[Jamman960]

STAS can be a real pain at times, I'd recommend running tests via the stas backend on the domain controllers to ensure it can contact the pc's in question via WMI/Registry, Occasionally firewall settings on the clients can interfere.

 

on a few occasions I've had to delete the stas database on the server with the app installed to clear stale/conflicting entries, comparing logs on the firewall authentication log and stas backend can reveal issues such as two users logging into the same machine via user switching etc, on one occasion a user with a special character in their username caused the firewall to continuously try and log that user on causing regular disconnects.

 

I've got to diagnose my own stats setup again shortly, I'm tempted to look at an alternative firewall solution when it comes up for renewal in May, there has to be a more reliable way to authenticate clients.

[lmrogers]

Good Morning,

 

Sorry to jump on an old thread but wondering if either of you have managed to resolve your issues or work out anything that may have been slightly wrong?

 

I've currently got it where STAS on the DCs does not appear to be reading all the login events.

 

Cheers

[geohanson]

Good Morning,

 

Sorry to jump on an old thread but wondering if either of you have managed to resolve your issues or work out anything that may have been slightly wrong?

 

I've currently got it where STAS on the DCs does not appear to be reading all the login events.

 

Cheers

 

The contract for our XG was up for renewal in August, so we swapped to an alternative. Never did manage to get to the bottom of it though...

Sorry, that's not much help!

[lg-wave9]

Hi Jamman960,

 

- Check the STAS client is started, either by the STAS client gui or the Windows Service 'Sophos Transparent Authentication Suite'

 

- Check the monitored subnet in STAS is correct, and your IP address of expected user is within that subnet

 

- Are eventIDs 4768 appearing in the DCs Event Viewer->Security log (you'll need to check all of your Domain Controllers)

 

If you're getting a 4768 in the event log:

 

- Check the logging events file in STAS to see if STAS is reading the events correctly. If the user's not appearing in STAS's 'Live Users' list when someone logs in to a PC, see if they appear in the log file STAS log file. If they're there, are they being skipped for any reason?

 

- Check your DCs (if you have more than one) can talk to each other. You can use the Advanced tab in STAS, putting the IP address of the other DCs in the 'STAS Collector' field and clicking the Test button next to the IP address.

 

- Ports 5566, 6677 and 50001 need to be open for STAS to work (and maybe 6060) and not held open by any other service, such as DNS Server (commonly holds open 50001).