matedwards
asked on
Sonicwall SSO
I have wireless users authenticating to our Sonicpoints with their AD credentials through a RADIUS server with no problems.
I have the Sonicwall SSO agent installed and connecting the Sonicwall and our DC.
I have our Sonicwall sending logs to a SysLog server with no problems.
However I cannot see any authenticated users traffic appearing in the syslogs?
Any help would be greatly appreciated.
I have the Sonicwall SSO agent installed and connecting the Sonicwall and our DC.
I have our Sonicwall sending logs to a SysLog server with no problems.
However I cannot see any authenticated users traffic appearing in the syslogs?
Any help would be greatly appreciated.
ASKER
Many thanks jspoor..
SSO is enforced on the wireless zone.
Users can log in with their AD credentials. The Sonicpoint is configured to pass the credentials to a RADIUS server that authenticates against a DC.
The firewall of the DC is turned off for now to get the SSO working.
When I 'check agent connectivity' it all works. When I 'check user' I only get the choice to choose 'netAPI'. Not 'From the Domain Controller' or 'Both'. (below) And get a [53] network path not found error.
Also, does this mean every client joined to the wireless zone has to have it's firewall turned off?
SSO is enforced on the wireless zone.
Users can log in with their AD credentials. The Sonicpoint is configured to pass the credentials to a RADIUS server that authenticates against a DC.
The firewall of the DC is turned off for now to get the SSO working.
When I 'check agent connectivity' it all works. When I 'check user' I only get the choice to choose 'netAPI'. Not 'From the Domain Controller' or 'Both'. (below) And get a [53] network path not found error.
Also, does this mean every client joined to the wireless zone has to have it's firewall turned off?
if users log in via radius, their ip is not in the dc security logs, so you need the agent to do netapi to the end station
use the check user test to see if the agent can query the end station
use the check user test to see if the agent can query the end station
error 53 usually means win firewall is blocking netapi queries
ASKER
Is there a way fo getting the user to authenticate straight to the DC (LDAP) not via a RADIUS server?
The Sonicpoint only shows how to configure WPA2-AUTO-EAP and RADIUS Server settings.
The Sonicpoint only shows how to configure WPA2-AUTO-EAP and RADIUS Server settings.
ASKER
I can query and end station if it is Windows (not Mac , Linux, or Chrome) and I turn off its firewall.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Will try first thing tomorrow.. Thanks for again for all your advice..
ASKER
The screenshot is to authenticate the client via 802.1x to the Access Point, not to the firewall (at this moment in time).
the SSO process or login to the webui will authenticate the user to the Firewall.
the SSO process or login to the webui will authenticate the user to the Firewall.
ASKER
The users are presented with a login webpage for authentication. And their names appear in the logs once they login.
Are the users logging into the DC?
Is file & printsharing enabled and allowed in the windows firewall for at least eh SSO agent?
View example configurations and the SonicWALL webui and features on http://livedemo.sonicwall.com or http://ngfw-demo.com
Multiply the effectiveness of your APT Sandbox, stop unknown and zero-day attacks at the gateway. See a demo on http://apt-demo.com or http://atp.demo.com
You can also view the Next-Generation Firewalls via
http://next-generation-firewall.com or http://next-generation-firewall-demo.com