Hi, I’m Tao from Sophos Support. Welcome to the second part in our STAS video series
which covers installation and configuration.
In part one, I gave an overview of the basic network setup and the function of STAS. The
link to this part is in the description.
In this part, I’ll guide you through the configuration steps for Sophos Firewall, the
Windows AD group policy
and the installation and configuration of STAS.
I’ll be demonstrating with Sophos Firewall version 18.5 and STAS version 2.5.1.
Please note: for STAS to function properly, you’ll need a valid Base Firewall license.
Let’s get started!
We’ll start with the Sophos Firewall configuration.
In Sophos Central, go to Administration.
In "Device access", enable "Client Authentication" on zones where STAS and user workstations
are located.
In our case, the Windows Server and workstation are in the LAN zone, so I will enable Client
Authentication here.
Next, we’ll configure an AD Domain Controller as an Authentication Server
Go to Authentication >> Servers
Click "Add".
Then, add the details of AD DC.
The Server Type is “Active Directory”
Under “Server Name”, enter an appropriate name.
Server IP is the IP address of the AD DC
In our case it is 192.168.20.5
For Connection Security, you can choose either “plaintext” or "SSL/TLS". We highly recommend
against plaintext connections as this can be security risk.
As for SSL/TLS, you’ll need to ensure that SSL has been enabled on the Windows LDAP service
for this to work.
Check out the documentation linked in the description for further information.
Set the port to 636. This is the default port for Active Directory with SSL/TLS enabled.
NetBIOS domain will be the NETBIOS name of the AD domain.
ADS username can be any account in AD Domain Admins group.
Domain name is the Fully Qualified Domain Name of the AD.
Search queries must be the LDAP search query which covers all AD users that need to be
detected by STAS and Sophos Firewall.
For more information on search queries and filters that can be used, refer to the documentation
in the video description.
Once the configuration is complete, click "Test connection" to make sure the Sophos
Firewall can communicate with AD domain controller.
Save the configuration settings.
Now you can add your group.
We recommend that you 'import an AD group into Sophos Firewall’, to make it easy for
user management.
Using the Import Group Wizard, I’ll import the group IT from the AD domain controller.
If we navigate to the Groups tab, we can see that the "IT" group has now been imported
into Sophos Firewall.
Then go to Authentication >> Services
Under Firewall Authentication Methods,
Add the domain controller as an authentication server
Now, create a firewall rule to give the IT group access to the WAN zone.
As rules can vary between environments, you will find documentation attached in the description
on rule creation.
When creating your firewall rule, I recommend keeping "Use web authentication for unknown
users" disabled, so that STAS can detect users via Logon type 1.
If this is enabled, web authentication occurs instead,
if Sophos Firewall doesn't detect a live user on a workstation.
Now, Go to Authentication >> STAS,
Enable and activate STAS
I highly recommend changing the STAS default settings.
By default, the Identity Probe time-out period is 120 seconds, or 2 minutes. We’ll set
the Identity probe time-out to 3 seconds.
Just below is Restrict client traffic during identity probe. It is important that this
is set to No. If this is enabled, workstations will be disconnected and have restricted traffic
until re-authenticated.
Most importantly set Restrict client traffic during identity probe to No
I also recommend activating ‘Enable user inactivity’.
Sophos Firewall will then remove any inactive users from the list of Live Users.
The next step is to add the STA collector into Sophos Firewall.
Click on "Add new collector"
Enter the IP address of the STA collector and keep the default port number.
For redundancy, Sophos Firewall supports multiple STA collectors.
If there are 2 STA collectors for the same AD domain, we can put them into the same collector
group.
You can add up to 5 collectors in a group.
Guided Steps > Configure Windows AD GPO
Now, we need to configure the Default Domain group policy to make sure Event ID 4768 is
generated when a user logs into a workstation.
On the domain controller, open Group Policy Management.
Right-click on Default Domain Policy and choose Edit.
Navigate to Computer Configuration
>> Policies
>> Windows Settings
>> Security Settings
>> Audit Policy
Then, open “Audit account logon events" and change policy setting to "success and
failure"
Next, go to Advanced Audit Policy Configuration
>> Audit Policies
>> Account Logon
Open "Audit Kerberos Authentication Service" and set Audit Events to "success and failure"
Finally, go to Logon/Logoff and set "Audit Logon" to "success and failure” as well.
In our example, we configure the STA collector to use WMI as the "workstation polling method"
We’ll need to create a firewall rule in the group policy to ensure that workstations
accept inbound WMI.
Under the Default Domain policy, go to Windows Firewall with Advanced Security.
Create a new Inbound Rule
Set the Rule Type to WMI
In Predefined Rules, check WMI-in
Set the Action to "Allow the connection"
Now, all workstations in the domain will accept inbound WMI requests.
Now, let's configure a Windows Firewall rule to allow traffic between the STA agent and
STA collector
and between the STA collector and Sophos Firewall
First, configure the firewall rule on the AD DC where STA agent was installed.
The agent needs to establish outbound connections to TCP port 5566 and UDP port 50001.
and accept inbound connections on UDP port 50001.
By default, Windows Firewall allows all outbound connections, so no configuration should be
needed here.
However, if the default action for outbound connections is blocked, we need to create
firewall rules to allow this.
Creating outbound rules is very straightforward.
Open "Windows Firewall with advanced security"
Right-click on "Outbound rules", then click on "New Rule..."
Allow TCP port 5566.
Then, create another outbound rule to allow UDP port 50001.
Next, create a firewall rule to allow inbound connections to UDP port 50001.
Right-click on "Inbound rules", then click on "New Rule..."
Allow UDP port 50001.
This completes the Windows Firewall configuration for the STA Agent.
We also need to configure Windows Firewall on the Server where the STA Collector was
installed.
The STA Collector establishes outbound connections to UDP Port 6060 on the Sophos Firewall and
UDP Port 50001 on the agent.
It accepts inbound connections on TCP port 5566, UDP port 6677 and 50001.
As mentioned before, by default Windows Firewall allows all outbound connections, so no configuration
should be needed.
However, if the outbound connections are blocked, we need to create a Firewall rule to allow
the outbound traffic.
On the Windows Server,
Open "Windows Firewall with advanced security"
Right click on "Outbound rules", then click on "New Rule..."
Allow UDP port 6060 and 50001.
Next, create Inbound Rules to accept connections from the STA agent and Sophos Firewall.
Right click on "Inbound rules".
Then click on "New Rule..."
Allow inbound connections on TCP port 5566.
Then, create another new rule.
This will accept inbound connections on UDP port 5566 and 50001.
Okay! We’ve now completed Windows Firewall configuration for the STA Collector.
The next step is to install the STA Agent on the AD DC.
First, download STAS from the Sophos Firewall webadmin.
Then, log into the Domain Controller as a member of the AD Domain Admins group
and install the STA agent.
Right-click on the installer file and 'Run as administrator'. This will prevent any potential
permission issues on Windows.
For type of setup, choose "STA agent".
then provide AD Domain admin account information and password.
It’s not necessary to be the administrator, but you must be a member of Domain Admins
group.
Click next and complete the installation.
Now, let's configure the STA agent.
Open STAS on the domain controller.
In the "General" tab, enter the NETBIOS name of the AD domain, together with the Fully
Qualified Domain Name
And then, click Start to launch the agent.
Wait a moment and the Current Status of STA Agent will display "Start"
If the STA agent cannot be started, please double check the Administrator Credentials
NetBIOS Name and Fully Qualified Domain Name.
Then, go to the "STA Agent" tab.
Set STA Agent Mode to ‘EVENTLOG’.
The Domain Controller IP must be blank if the STA agent is installed on an AD DC.
In this video, I installed STA agent on the ADDC, so the option should be blank.
Monitor Networks is the network address of the AD workstations.
In our example, this is 192.168.20.0/24
Under Collector List, click “Add”
to add the IP address of our STA Collector.
In our example, this is 192.168.20.9
Remember to click on "OK" to save the configuration.
Sometimes, the STAS service may fail to start. When this happens, you’ll receive an error
message showing a logon failure.
There is a quick fix to this.
Go to “Windows Service”,
find “Sophos Transparent Authentication Suite”
Right-click on it, and choose "Properties"
Go to the "Log On" tab,
and enter the AD Domain admin account and password again.
Return to the STA Agent.
Click the "Start" button
and now, the STA agent should Start.
If STA Agent still cannot be started, please contact Sophos Technical support to fix the
problem.
With the STA Agent installed and configured, our next step is to install the STA Collector
on the Windows server
We’ll use the same STAS installer file used to install the STA Agent.
Login to the Windows server as a member of the AD Domain Admins group.
Right-click the installer and 'Run as administrator'.
This time, choose "STA Collector" for the setup type.
Provide the AD Domain admin account info, together with its password.
Again, it’s not necessary to be the administrator, but you must be a member of AD Domain Admins
group.
Click next and complete the installation.
Now, let's configure the STA Collector.
Open STAS on the Windows Server.
In the "General" tab, enter the NETBIOS name of the AD domain, as well as Fully Qualified
Domain Name.
Then, click on Start button to launch the STA Agent.
Now, go to the "STA Collector" tab.
In Sophos Appliances, enter the internal IP address of your Sophos Firewall.
For Workstation Polling Method, I will use WMI.
Then, Enable Logoff Detection and set “Detection Method” to “Workstation polling”.
Dead entry timeout must be set to 0. Any other value will prevent STAS from working.
Next, go to the "Exclusion List" tab.
We recommend configuring "Login User Exclusion List", to stop the STA Collector from detecting
unnecessary usernames, such as Background Service Account which is normally used by
the Antivirus software updater.
Here, I will add in trendupd, trendupd2, and OktaService.
You might need to add other usernames, depending on the software installed on your workstation.
This prevents AD users from being logged off from Sophos Firewall when a background service
account logs in to the workstation.
Please note: the login user Exclusion List is not case sensitive.
In addition, entries must be the username only.
Do not include the prefix of the NetBIOS name or the suffix of domain name
We also need to configure the "Login IP Address or Network Exclusion List".
STAS is designed to detect users on workstations and not servers, so we need to filter out
any usernames on Windows Servers.
Add the IP address of any server.
For example, Citrix terminal server, Microsoft RDS server, DNS server or web server.
Here, I will enter the IP addresses of the DNS server and web server.
Click "OK" to save the configuration.
Then, start STAS again.
Returning to the "General " tab, we now see that the IP address of Sophos Firewall is
listed as served Sophos Appliance.
This indicates STA Collector has successfully established communication with Sophos Firewall.
Now that STAS has been installed and configured, verify STAS is working properly.
Log off from the workstation and then login once again.
Go to the STA Collector, STAS > Advanced > "Show Live Users".
This displays the live users detected by the STA Collector
You can also see the STAS live users under:
Sophos Firewall webadmin > Current activities > Live users
So that completes the STAS installation.
I hope you found this video series useful! Let us know by giving us a thumbs up on
Techvids and let us know if we resolved your issue.
Check out the documentation for this video in the video description.
For further assistance, view and post questions on community.sophos.com.
And go to techvids.sophos.com for more great videos like this one!
Thanks for watching!