Solved

Sonicwall SSO

Posted on 2016-09-05
11
60 Views
Last Modified: 2016-09-14
I have wireless users authenticating to our Sonicpoints with their AD credentials through a RADIUS server with no problems.

I have the Sonicwall SSO agent installed and connecting the Sonicwall and our DC.
 
I have our Sonicwall sending logs to a SysLog server with no problems.

However I cannot see any authenticated users traffic appearing in the syslogs?

Any help would be greatly appreciated.
0
Comment
Question by:matedwards
  • 6
  • 5
11 Comments
 
LVL 7

Expert Comment

by:J Spoor
ID: 41784976
Is SSO enforced on the zone?
Are the users logging into the DC?
Is file & printsharing enabled and allowed in the windows firewall for at least eh SSO agent?



View example configurations and the SonicWALL webui and features on http://livedemo.sonicwall.com or http://ngfw-demo.com

Multiply the effectiveness of your APT Sandbox, stop unknown and zero-day attacks at the gateway. See a demo on http://apt-demo.com or http://atp.demo.com

You can also view the Next-Generation Firewalls via
http://next-generation-firewall.com or http://next-generation-firewall-demo.com
0
 

Author Comment

by:matedwards
ID: 41785225
Many thanks jspoor..

SSO is enforced on the wireless zone.

Users can log in with their AD credentials. The Sonicpoint is configured to pass the credentials to a RADIUS server that authenticates against a DC.

The firewall of the DC is turned off for now to get the SSO working.

When I 'check agent connectivity' it all works. When I 'check user' I only get the choice to choose 'netAPI'. Not 'From the Domain Controller' or 'Both'. (below) And get a [53] network path not found error.

Also, does this mean every client joined to the wireless zone has to have it's firewall turned off?




 netAPI.png
0
 
LVL 7

Expert Comment

by:J Spoor
ID: 41785231
if users log in via radius, their ip is not in the dc security logs, so you need the agent to do netapi to the end station

use the check user test to see if the agent can query the end station
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 7

Expert Comment

by:J Spoor
ID: 41785233
error 53 usually means win firewall is blocking netapi queries
0
 

Author Comment

by:matedwards
ID: 41785238
Is there a way fo getting the user to authenticate straight to the DC (LDAP) not via a RADIUS server?

The Sonicpoint only shows how to configure WPA2-AUTO-EAP and RADIUS Server settings.
0
 

Author Comment

by:matedwards
ID: 41785244
I can query and end station if it is Windows (not Mac , Linux, or Chrome) and I turn off its firewall.
0
 
LVL 7

Accepted Solution

by:
J Spoor earned 500 total points
ID: 41785258
you can have them login to the firewall webui,
if you in the LDAP config, set the default group to trusted users,
then create a WLAN to WAN firewall rule for service HTTP with users trusted users, when not authenticated they will get a login page.
0
 

Author Comment

by:matedwards
ID: 41785264
Will try first thing tomorrow.. Thanks for again for all your advice..
0
 

Author Comment

by:matedwards
ID: 41785828
A little confused as to what actually authenticates the user?

The LDAP + Local users authentication works in the Sonicwall.

But the sonicpoints themselves only have configuration for RADIUS not LDAP. (below)

radius.JPG
0
 
LVL 7

Expert Comment

by:J Spoor
ID: 41785863
The screenshot is to authenticate the client via 802.1x to the Access Point, not to the firewall (at this moment in time).

the SSO process or login to the webui will authenticate the user to the Firewall.
0
 

Author Closing Comment

by:matedwards
ID: 41798259
The users are presented with a login webpage  for authentication. And their names appear in the logs once they login.
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is a step by step guide on how to create a basic PTP link using Ubiquiti airOS devices. This guide can be used on the following Ubiquiti AirMAX devices. Nanostation, Bullets, AirBridge, Nanobeam, NanoBridge to name a few. Please review …
For Sennheiser, comfort, quality and security are high priority areas. This paper addresses the security of Bluetooth technology and the supplementary security that Sennheiser’s Contact Center and Office (CC&O) headsets provide.  
This Micro Tutorial will show you how to maximize your wireless card to its maximum capability. This will be demonstrated using Intel(R) Centrino(R) Wireless-N 2230 wireless card on Windows 8 operating system.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question