configure the appliance to use the same NTP server, which is configured on the Configuration >
System > Time Zone page.
Active Directory authentication options are configured on the System: Authentication page.You
can authenticate users with a single sign on, through a captive portal, or use a combination of
the two. By creating authentication profiles and connection profiles, you can specify different
authentication methods for different connections. For more information, see “Authentication”.
Related concepts
on page 131
Related tasks
Configuring Firefox for Active Directory in Transparent mode or Bridged mode
on page 202
on page 122
4.4.5.1 Configuring Active Directory Access
On this page of a joined Web Appliance, most of the options are unavailable because they are
controlled from the Management Appliance. The main exception is Configure Active Directory
settings locally, which is described below.
Important: Firewall Configuration: If you have a firewall between the appliance and your Active
Directory server, you need to ensure that ports 88 and 389 are open for both TCP and UDP, and
that ports 445 (raw SMB) and 139 (NetBIOS over TCP/IP) are open for TCP on that firewall in
order to perform Active Directory authentication.
Requirements for an Active Directory Forest: Sophos supports the integration of an Active
Directory forest with the appliance only if the following conditions apply:
■
Integrate with only a single Active Directory forest containing a single Active Directory tree.
■
The Active Directory server to which you configure access must be the root domain controller
of the Active Directory forest.
■
The root domain of your Active Directory forest must have an explicit trust relationship with all
subdomains within the forest. If this condition does not exist, users will be able to authenticate,
but the appliance will not be able to synchronize Active Directory groups membership
information, which will result in all affected users having only the default Web Appliance policy
applied to them.
■
The Active Directory administrator account that you use to access the Active Directory forest
must have valid credentials on all subdomains for authenticating users and accessing LDAP
information.
■
In addition to the firewall configuration described above, you must ensure that port 3268 is
open for both TCP and UDP between your appliance and your Active Directory server, that
use of the global catalog is properly configured on your Active Directory server, that TCP
access from the appliance to your Active Directory server, and that bi-directional UDP traffic
between the two is allowed. Also, port 389 must be open between the appliance and all domain
controllers within the Active Directory forest.
■
Ensure that the domain controllers have the global catalog enabled, including on any backup
domain controllers. If you do not, problems may occur when the appliance attempts to
124 | Configuration | Sophos Web Appliance
