Sophos XG user authentication issues

[laurencejones]

Is anyone else using a Sophos XG firewall and suddenly having issues with user authentication webpage appearing at regular intervals? Seems to be since the latest Windows 10 / 11 updates on Tuesday 14th June.

 

Normally domain PCs authenticate to the firewall using STAS, so they shouldn't ever see the login page unless the firewall is restarted. There is a Sophos certificate deployed to all domain PCs through AD to allow HTTPS decryption, but we have had to disable this and also the match known users settings to allow people to access the internet without the user authentication page re-appearing every 20-30 minutes.

[Wave9_Lee]

Is anyone else using a Sophos XG firewall and suddenly having issues with user authentication webpage appearing at regular intervals? Seems to be since the latest Windows 10 / 11 updates on Tuesday 14th June.

 

Normally domain PCs authenticate to the firewall using STAS, so they shouldn't ever see the login page unless the firewall is restarted. There is a Sophos certificate deployed to all domain PCs through AD to allow HTTPS decryption, but we have had to disable this and also the match known users settings to allow people to access the internet without the user authentication page re-appearing every 20-30 minutes.

We haven't seen any issues like this across 500 sites or so. Have you checked that times are out of synhc on the client?

[laurencejones]

Thanks for your suggestion Lee. We have now worked out that STAS Polling was failing and that subsequently caused the session to get logged off. This seems to have started happening following a Windows Update as only W10 / W11 PCs that got the update had the issues. The STAS Polling utility (WMI Verification) in the Sophos Transparent Authentication Suite was failing with Incorrect Password error, despite the password being correct (it was working with the W10 PCs that didn't get the Windows Update).

Seems to be fixed now by adding a registry entry and also a further Windows Update thankfully. We also implemented a temporary measure of disabling Logoff Detection on Sophos Transparent Authentication Suite as that was what was causing the problems when WMI failed.