Smoothwall IDex Agent not working

[5tu]

Morning all

 

We've had the Idex Agent installed on our DCs for a while now handling proxy authentication for our Apple Mac clients. This stopped working relatively recently (possibly after Leeds 59 update but unsure). The DCs have the required Audit policies enabled and logon 4624 events are being logged in the Security Event Logs. Despite this our AD bound Macs still get filtered as "Unauthorised Clients" as the Smoothwall isn't detecting user logons. Core Auth is selected on our Transparent Auth policy, as it always has been.

 

Installed Idex Agents on DCs were (the now legacy) version 1 and I have upgraded them all to version 2 but the issue remains.

 

I've raised a ticket but am awaiting help from support.

 

Anyone else seen this problem and found a solution?

 

Thanks

[Shadow_Walker]

Just a random one to to check in Network > Firewall > Smoothwall Access is the idex cluster service in there?

[5tu]

Yes it is, but thanks for the suggestion :-)

 

Firewall logs show the Idex Agents are successfully talking to the Smoothwall so I can only assume that the agents themselves aren't detecting the logons.

Edited July 5, 2022 by gybe78

[DGardiner]

Any word on what the v2 idex agents benefits are? i notice it has some settings for cloud etc.. but cant find any documentation on the smoothwall kb Edited July 5, 2022 by DGardiner

[5tu]

Any word on what the v2 idex agents benefits are? i notice it has some settings for cloud print etc.. but cant find any documentation on the smoothwall kb

 

No idea - just saw it was available and tried it as I had exhausted all other ideas

[DGardiner]

No idea - just saw it was available and tried it as I had exhausted all other ideas

 

If you go into the realtime system report on the machine, check to see if youre seeing authentication errors in the authentication filter

[5tu]

If you go into the realtime system report on the machine, check to see if youre seeing authentication errors in the authentication filter

 

Thanks for the suggestion but System > Authentication logs all look good - no errors.

 

And under Settings > Authentication > Directories my IDex Directory shows a healthy status.

[DGardiner]

Also im assuming you have - created an idex directory in the directories

[DGardiner]

Have you changed the relevant proxy to core authentication?

 

 

edit: nvm!

Edited July 5, 2022 by DGardiner

[5tu]

Also im assuming you have - created an idex directory in the directories

 

Yup - as I say we've had it working for a long time..... it's only recently stopped detecting logins.

[DGardiner]

What may be a shout is to deploy the idex client to the macs if the agent isnt working, but id assume if the login events are showing on the server it should work

[Shadow_Walker]

Is the user activity screen are there any users shown in there?

[ibpalle]

The event viewer - windows - applications - will show entries from the iDex agent. It may show what's going on. You can try to clear iDex info in the services - authentication - settings as well. If you do that, run the program files\smoothwall\idexagent\sendaddatanow.exe on one DC with the installed iDex agent to update the iDex directory on the SMoothwall with the AD groups again.

[5tu]

Thanks for the suggestion. Have already cleared the IDex info and run sendaddatanow.exe on a DC which completed successfully.

 

The Application Event log on the DCs just show entries every few seconds saying "There were no new logons to send". It's as though the Agents aren't detecting the events in the Security Event Log.

[ibpalle]

What are the numbers shown in the diagnostics for the idex directory - hover over it in services - authentication - directories and the diag button should pop up. If you try a domain login on a normal PC/Laptop, any results? Edited July 5, 2022 by ibpalle

[5tu]

What are the numbers shown in the diagnostics for the idex directory - hover over it in services - authentication - directories and the diag button should pop up.

 

Please see screenshot below....

 

[5tu]

All entries listed under Services > Authentication > User Activity show "Negotiate" as the auth method - these are all Windows domain client logins. For Mac clients there are no entries at all. Edited July 5, 2022 by gybe78

[ibpalle]

If the kerberos login script is running on clients, those will overwrite the iDex logins. The script refreshes every 2 minutes.

 

Try looking at the reports - realtime - system and select authentication in the section drop down list. Do you see any iDex activity there?

 

Everything in the diag looks fine.

[5tu]

We don't use the kerberos login script (& never have).

 

There isn't anything iDex related showing in the Realtime > System > Authentication log. Should there be?

[tdk1069]

We had an issue recently where iDex stopped working totally every night after the login purge , reboot smoothwall and it all worked again. No one was being authenticated and getting the basic levels where applicable (Tho these were all domain joined machines)

 

In the end we had to disable the "Enable Daily login purge" and it stopped happening. Always had it on, always at 3am, then just stopped...

[5tu]

We had an issue recently where iDex stopped working totally every night after the login purge , reboot smoothwall and it all worked again. No one was being authenticated and getting the basic levels where applicable (Tho these were all domain joined machines)

 

In the end we had to disable the "Enable Daily login purge" and it stopped happening. Always had it on, always at 3am, then just stopped...

 

Thanks @tdk1069 - I'll reboot tonight and see if anything changes.

[5tu]

As we have a failover Smoothie I bit the bullet and rebooted - and what do you know iDex is now working!

 

Thanks everyone for your input - @tdk1069 I'll be sure to check what happens after the 3am purge.

[tom_newton]

Idex agent v2 is just a rebuild that's easier to debug, and talks to our cloud services if needed. No pressing need to upgrade.

[tdk1069]

As we have a failover Smoothie I bit the bullet and rebooted - and what do you know iDex is now working!

 

Thanks everyone for your input - @tdk1069 I'll be sure to check what happens after the 3am purge.

 

If it's what happened at two of our schools reboot fixed it (we have failovers too! and one school is a child of the other) but only till the purge, We ended up just turning off the 3am purge at both those sites in the "Hidden Backen" (Still laugh at the name) @ /ui/admin/hbd

[supportman]

Just got this working, the instructions are ok but over about 4 different pages quite convoluted.

 

I also tripped up adding the firewall rule as that wasn't clear either.

 

All fine once you get trough to 2nd level support though.

 

Is there any advantage to installing the idex client on devices as well as the agent on the domain controller?