NSA 2650 Logging Out Randomly

Answers

• compunext_rogerio Newbie ✭

  January 2023

  I figured out what is happening.

  We use SSO Agent for User Authentication.

  Many Microsoft Services are installed on internal servers, such as Azure AD Connect and Microsoft Exchange. These services create users for internal processes and these internal users open cloud or internal communication processes.

  While using firewall administration web GUI, I am considered to be a valid authenticated user.

  Perhaps, when configured with SSO Agent, SonicWall firewall validate user logged on the firewall services, including web administration GUI. Thus, when SonicWall firewall compare my user logon name with service user name detected on the computer queried by SSO Agent, inconsistency is achieved, forcing logout of my user account from NSa 2650.

  This is the error message logged by NSa 2650:

  myusername@internal-ad.domain, logout reported by SSO agent. Session ID mismatch: user was 0, reported as 9636. User name mismatch. user was internal-ad.domain/myusername, reported as internal-ad.domain/MSOL_ef7(internal_service_user)

  This is the user detected by SSO Agent :

  

  This internal service user was detected by DC Security Logs.

  I checked SSO Agent Screen and found the following:

  

  Internal service users were not listed to be excluded.

  Azure AD Connect creates a user account called MSOL_(user_GUID). Exchange 2016 creates a user called HealthMailbox(user_GUID).

  I added the following users inside SSO Agent "Excluded Users" configuration:

  

  Other internal service users may be added according to your AD environment.

  So, as your environment grows, customization may be needed to avoid authentication issues.

  Thanks a lot for everyone!

  1