Transcript
with Sophos Firewall. Let's dive in. In this TechVid, I'll show you how to add an Active Directory or AD server for authentication, import AD groups, and finally how to set AD as the primary authentication method. Before starting, make sure you're using a supported version of Sophos Firewall. This TechVid is demonstrated in SFOS version 21, so the steps and user interface shown may differ slightly in later versions. Next, make sure you have administrator rights to access your AD. You also need a domain user with rights to read AD group membership. Let's get started. First, add the AD server. In this TechVid, I'll be using the domain nointerface.ca. In Sophos Firewall, navigate to authentication. Make sure you're in the servers tab, then click AD. This opens the AD external server page, providing the configuration options for the server. In the server type, select Active Directory, then specify the server name. In this case, I'll name it Active Directory, and the server IP or domain is 10.2.0.100. In connection security, there are three options. Plain text, SSL TLS, or Start TLS. For SSL TLS or Start TLS, you need to install the Active Directory Certificate Services, or ADCS, role. In my case, I'll use SSL TLS. For steps on issuing a certificate in your domain controller using Active Directory Certificate Services, refer to the link in the video description. Next, to find the NetBIOS domain on your computer, go to Active Directory Users and Computers. Right-click the domain name and select Properties. Under Domain Name, you see the NetBIOS name, no interface. Copy this and paste it into the server configuration page. Next, add the server attributes for ADS username, password, and domain name. And lastly, enter the search query by clicking Add. In this case, the search query is OU equals VPN underscore users comma DC equals no interface comma DC equals CA. Note, when entering a search query, make sure there are no spaces and use commas in place of periods in the domain name. Click Add. Now, click Test Connection to validate the credentials. And you can see a notification that the test was successful. Click Save to finish the server configuration. The next step is to import AD groups. Click the Import icon to launch the Import Group Wizard, which guides you through the process in a few steps. Click Start to begin. In Step 1, go to the Base DN Search Queries drop-down menu and select the search query that was just created. Click the Next arrow to proceed. In Step 2, select the AD groups to import. Then, click Next. Here, you can select Common Policies for Groups. Once you've made your selections, click Next. In this case, Step 4 isn't necessary, so the Wizard tool skips directly to Step 5, showing a summary of the selections for review. Everything looks fine, so click Next followed by OK to migrate the groups to the device. Back in Sophos Firewall, go to the Groups tab to verify the recently imported AD groups. You're now ready to set Active Directory as a primary authentication method. Go to the Services tab. In the Authentication Server list, select Active Directory and move it to the first position in Selected Authentication Server. For the default group setting, choose the group to place users who are not explicitly assigned to any local group. By default, the default group is set to Open Group. Note, to create a profile on Sophos Firewall, the user must authenticate using one of the available methods. If the user doesn't belong to a local group, they'll be automatically added to the default group. Now, click Apply followed by OK to set the authentication method. The authentication method is now applied and the Active Directory Authentication Server has been added to the services on the page. For steps on issuing a certificate in your domain controller using Active Directory Certificate Services, refer to the link in the video description. That completes the steps to integrate Active Directory with Sophos Firewall. I hope you found this useful. The relevant documentation and other comprehensive resources for this tech vid are linked in the video description. Join the Sophos community to stay up to date with our products, ask questions, and get answers from Sophos experts. And go to Sophos TechVids for more expert tutorials to help you maximize your products and stay secure. See you next time.
