Solved

Sonicwall SSO

Posted on 2016-09-05
11
40 Views
Last Modified: 2016-09-14
I have wireless users authenticating to our Sonicpoints with their AD credentials through a RADIUS server with no problems.

I have the Sonicwall SSO agent installed and connecting the Sonicwall and our DC.
 
I have our Sonicwall sending logs to a SysLog server with no problems.

However I cannot see any authenticated users traffic appearing in the syslogs?

Any help would be greatly appreciated.
0
Comment
Question by:matedwards
  • 6
  • 5
11 Comments
 
LVL 6

Expert Comment

by:J Spoor
ID: 41784976
Is SSO enforced on the zone?
Are the users logging into the DC?
Is file & printsharing enabled and allowed in the windows firewall for at least eh SSO agent?



View example configurations and the SonicWALL webui and features on http://livedemo.sonicwall.com or http://ngfw-demo.com

Multiply the effectiveness of your APT Sandbox, stop unknown and zero-day attacks at the gateway. See a demo on http://apt-demo.com or http://atp.demo.com

You can also view the Next-Generation Firewalls via
http://next-generation-firewall.com or http://next-generation-firewall-demo.com
0
 

Author Comment

by:matedwards
ID: 41785225
Many thanks jspoor..

SSO is enforced on the wireless zone.

Users can log in with their AD credentials. The Sonicpoint is configured to pass the credentials to a RADIUS server that authenticates against a DC.

The firewall of the DC is turned off for now to get the SSO working.

When I 'check agent connectivity' it all works. When I 'check user' I only get the choice to choose 'netAPI'. Not 'From the Domain Controller' or 'Both'. (below) And get a [53] network path not found error.

Also, does this mean every client joined to the wireless zone has to have it's firewall turned off?




 netAPI.png
0
 
LVL 6

Expert Comment

by:J Spoor
ID: 41785231
if users log in via radius, their ip is not in the dc security logs, so you need the agent to do netapi to the end station

use the check user test to see if the agent can query the end station
0
 
LVL 6

Expert Comment

by:J Spoor
ID: 41785233
error 53 usually means win firewall is blocking netapi queries
0
 

Author Comment

by:matedwards
ID: 41785238
Is there a way fo getting the user to authenticate straight to the DC (LDAP) not via a RADIUS server?

The Sonicpoint only shows how to configure WPA2-AUTO-EAP and RADIUS Server settings.
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 

Author Comment

by:matedwards
ID: 41785244
I can query and end station if it is Windows (not Mac , Linux, or Chrome) and I turn off its firewall.
0
 
LVL 6

Accepted Solution

by:
J Spoor earned 500 total points
ID: 41785258
you can have them login to the firewall webui,
if you in the LDAP config, set the default group to trusted users,
then create a WLAN to WAN firewall rule for service HTTP with users trusted users, when not authenticated they will get a login page.
0
 

Author Comment

by:matedwards
ID: 41785264
Will try first thing tomorrow.. Thanks for again for all your advice..
0
 

Author Comment

by:matedwards
ID: 41785828
A little confused as to what actually authenticates the user?

The LDAP + Local users authentication works in the Sonicwall.

But the sonicpoints themselves only have configuration for RADIUS not LDAP. (below)

radius.JPG
0
 
LVL 6

Expert Comment

by:J Spoor
ID: 41785863
The screenshot is to authenticate the client via 802.1x to the Access Point, not to the firewall (at this moment in time).

the SSO process or login to the webui will authenticate the user to the Firewall.
0
 

Author Closing Comment

by:matedwards
ID: 41798259
The users are presented with a login webpage  for authentication. And their names appear in the logs once they login.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

This subject  of securing wireless devices conjures up visions of your PC or mobile phone connecting to the Internet through some hotspot at Starbucks. But it is so much more than that. Let’s look at the facts: devices#sthash.eoFY7dic.
For Sennheiser, comfort, quality and security are high priority areas. This paper addresses the security of Bluetooth technology and the supplementary security that Sennheiser’s Contact Center and Office (CC&O) headsets provide.  
This Micro Tutorial will show you how to maximize your wireless card to its maximum capability. This will be demonstrated using Intel(R) Centrino(R) Wireless-N 2230 wireless card on Windows 8 operating system.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now