RADIUS SSO Sophos Filter

[lmrogers]

Morning,

 

Just wondering if someone can point me in the right direction.

 

Over Easter, I setup a Sophos XG firewall and filter. Configured RADIUS SSO for our Unifi wireless system and confirmed that it is working. The RADIUS account is sent to the NPS server which then forwards the accounting onto the XG. However, the XG seems to be randomly dropping the user authentication and giving the users an unauthenticated web filter policy that I setup.

 

It will eventually reauthenticate them on its own or by disconnecting and reconnecting the wireless triggers the XG to reauthenticate them.

 

Thanks

[altecsole]

Do you have the IP address of each Unifi AP added under Authentication -> SSO using RADIUS account request on the XG?

[lmrogers]

Do you have the IP address of each Unifi AP added under Authentication -> SSO using RADIUS account request on the XG?

 

No, I just have the NPS server listed there as that is where the accounting is being forwarded from.

 

Should I put the APs in there and have accounting sent straight from the APs to the XG like that?

[altecsole]

I have my UniFi WiFi setup as WPA Enterprise and the UniFi RADIUS profile uses our NPS server for authentication and the XG for RADIUS accounting. The IP address of each AP is then added to XG.

[lmrogers]

I'll give that a go. I do suspect that the issue is because of roaming around the different APs so that should sort that out.

[lmrogers]

I have my UniFi WiFi setup as WPA Enterprise and the UniFi RADIUS profile uses our NPS server for authentication and the XG for RADIUS accounting. The IP address of each AP is then added to XG.

 

I've tried to do the same but can only seem to add 16 of my 32 APs as it then says it cannot add any more RADIUS clients than that.

[altecsole]

I've tried to do the same but can only seem to add 16 of my 32 APs as it then says it cannot add any more RADIUS clients than that.

 

Ah... We're only using 9 APs, so I've not run into that issue! It's a shame that the APs don't report to the UniFi Controller and then the UniFi Controller reports to XG. That's how our Ruckus system works.

 

I'm sure Sophos support, and UniFi community can advise.

 

Sorry I wasn't able to help.

[robyholmes]

Can you add a range? I have a Smoothwall myself and I have all the APs in a range then just add that as a single client.

[lmrogers]

Ah... We're only using 9 APs, so I've not run into that issue! It's a shame that the APs don't report to the UniFi Controller and then the UniFi Controller reports to XG. That's how our Ruckus system works.

 

I'm sure Sophos support, and UniFi community can advise.

 

Sorry I wasn't able to help.

 

Yeah its a bit of a shame, will work something out though. Cheers for the pointers.

[lmrogers]

Can you add a range? I have a Smoothwall myself and I have all the APs in a range then just add that as a single client.

 

Nope, not able to add a range. The Sophos documentation seems to point to having the NPS server forward the accounting from NPS which works just sporadically.

[lg-wave9]

Hi there. If you SSH to your XG and go to the advanced shell (option 5, option 3), try taking a look at the log file in /log/access_server.log. If you then 'tailf /log/access_server.log' and see what you find when the session disconnects (you should be able to add '| grep yourusername' on to the end of your tailf command, if you're getting swampted by other users).

[lmrogers]

MESSAGE   Apr 22 10:31:29.916557 [access_server]: handle_radius_account_req:  request received from radius client NPSSERVERIPERROR     Apr 22 10:31:29.916600 [access_server]: handle_radius_account_req: received radius accounting with status  2ERROR     Apr 22 10:31:29.916624 [access_server]: (_sqlite_db_handle_get_liveuserinfo): GET_LIVEUSER_INFO_TO_LOGOUT found no entries for IP BYODIPADDRESS (sqrs 101)ERROR     Apr 22 10:31:29.916635 [access_server]: (handle_external_logout_req_finish_free): SQLITE_REQ_GETLIVEUSERINFO query failedMESSAGE   Apr 22 10:31:36.750328 [access_server]: handle_radius_account_req:  request received from radius client NPSSERVERIPERROR     Apr 22 10:31:36.750351 [access_server]: handle_radius_account_req: received radius accounting with status  2MESSAGE   Apr 22 10:31:38.276044 [access_server]: handle_radius_account_req:  request received from radius client NPSSERVERIPERROR     Apr 22 10:31:38.276087 [access_server]: handle_radius_account_req: received radius accounting with status  1MESSAGE   Apr 22 10:31:39.027107 [access_server]: handle_radius_account_req:  request received from radius client NPSSERVERIPERROR     Apr 22 10:31:39.027126 [access_server]: handle_radius_account_req: received radius accounting with status  1MESSAGE   Apr 22 10:31:39.027169 [access_server]: (handle_req_no_password): User 18oelks with clienttype 23 already live, ignoring the requestMESSAGE   Apr 22 10:31:40.377564 [access_server]: handle_radius_account_req:  request received from radius client NPSSERVERIPERROR     Apr 22 10:31:40.377606 [access_server]: handle_radius_account_req: received radius accounting with status  2MESSAGE   Apr 22 10:31:43.796939 [access_server]: handle_radius_account_req:  request received from radius client NPSSERVERIPERROR     Apr 22 10:31:43.796962 [access_server]: handle_radius_account_req: received radius accounting with status  2MESSAGE   Apr 22 10:31:46.146647 [access_server]: handle_radius_account_req:  request received from radius client NPSSERVERIPERROR     Apr 22 10:31:46.146669 [access_server]: handle_radius_account_req: received radius accounting with status  1MESSAGE   Apr 22 10:31:46.373840 [access_server]: handle_radius_account_req:  request received from radius client NPSSERVERIPERROR     Apr 22 10:31:46.373863 [access_server]: handle_radius_account_req: received radius accounting with status  2MESSAGE   Apr 22 10:31:46.558429 [access_server]: handle_radius_account_req:  request received from radius client NPSSERVERIPERROR     Apr 22 10:31:46.558464 [access_server]: handle_radius_account_req: received radius accounting with status  2

 

This is a snippet of the access_server.log. Getting loads of these errors for some reason. But I am also seeing times where it can find the user as active so does not process the packet.

 

Is anyone else having these issue with a Unifi wireless solution?

[lg-wave9]

Hi there,

This sounds like a Framed-IP address problem (the XG is expecting that info, but the AP isn't sending it).

 

If using NPS (just to check), you need to add the XG as a remote RADIUS server and then pass RADIUS accounting to it:

 

Then configure your XG:

[lmrogers]

Hi there,

This sounds like a Framed-IP address problem (the XG is expecting that info, but the AP isn't sending it).

 

If using NPS (just to check), you need to add the XG as a remote RADIUS server and then pass RADIUS accounting to it:

[ATTACH=CONFIG]61583[/ATTACH]

 

Then configure your XG:

[ATTACH=CONFIG]61584[/ATTACH]

 

So that's how I have got it set and in the connection request policies, I have a wireless connections policy which forwards the accounting to the Sophos XG (Remote RADIUS Server Group).

 

It's just a bit strange how it will randomly drop auth on the Sophos and pick it back up again.

[lmrogers]

Just running Wireshark capture on the NPS server I can see that in the Accounting-Request packets it is receiving a Framed-IP-Address.

[lmrogers]

Quick update on this and looking for some more ideas if possible.

 

Setup is a 32 Access Point Unifi wireless system, Sophos XG Filter, Windows Server NPS. Accounting is forwarded from the NPS Server to the Sophos XG Filter. I can see the start and stop messages being sent through a packet capture. Authentication continues to work fine but accounting appears to drop as the web filter from the Sophos XG appears to lose authentication. There is no interim account on the Unifi.

 

I have managed to recreate the problem: laptop loses XG authentication and get blocked page in Location A, move to location B and XG reauthenticates, can access the appropriate sites for users web filter. Move back to Location A, works fine momentarily before then losing XG authentication again. I can also disconnect and reconnect the wireless in Location A to reauthenticate with the XG, this solves the problem for an undefined period of time.

 

I'm running out of ideas what to try, if anyone has any help that would be great.

 

Thanks!!

[lmrogers]

Update:

 

Issue resolved, was a combination of firmware upgrades and some slight network config changes.

 

Huge thanks to the guys at Wave9 for assisting!

[aac]

Hi there

 

I have been troubleshooting an issue which seems almost identical to this for weeks. Could you explain what you did to resolve it please? We have UniFi wireless system and Always On VPN. My UniFi system is fully up to date in terms of firmware.

 

Many Thanks

 

Adam Clarke

[Oaktech]

I've seen another thread about this today - turned out to be needing a firmware update.

[angelobrg]

Can you provide more details on what you did to resolve the issue? I'm going through the same situation.

 

[

QUOTE=lmrogers;1900133]Update:

 

Issue resolved, was a combination of firmware upgrades and some slight network config changes.

 

Huge thanks to the guys at Wave9 for assisting!

[lmrogers]

I'll be honest, I can't really remember, other than updating the firmware on both the XG and the Unifi.

 

I think at one point I also had the Intercept X agent installed on the laptops and that was interferring with the Heartbeat auth because it wasn't sending the right domain through with the username, so I ended up turning Heartbeat auth off on the XG. I did then fix that issue though by adding a second DC and domain into the XG for authentication.

[angelobrg]

Can you inform the firmware versions you are using on Unifi and Sophos?

[lmrogers]

I'm not too sure. I've since moved on from that school. It was certainly prior to the latest version of the control OS on the Unifi and I believe it was SFOS 17 on the XG.