Set up STAS on Sophos Firewall

STAS stands for Sophos Transparent Authentication Suite. It reports Windows logons from Active Directory together with the corresponding client IP to Sophos Firewall. This allows users and AD groups to be used in firewall rules without an additional browser or portal logon.

Quick setup

1. Prepare AD audit events, the service account and the required connections.
2. Configure Active Directory as the primary authentication method on the firewall.
3. Install and configure the STA Agent and STA Collector.
4. Enable STAS on the firewall, add the Collector and allow Client Authentication for the client zones.
5. Log a user on again at a domain client and check the mapping under Advanced > Show live users and Current activities > Live users.
6. Test a user-based firewall rule with logging.

The following Sophos Techvids show the architecture and setup with SFOS 21. The basic principle still applies; some screens look slightly different in SFOS 22.

Planning and requirements

STAS is suitable for Windows clients in an AD domain when one client IP normally belongs to exactly one user. The firewall must see the same client IP that STAS reports. NAT, proxy systems or other gateways between the client and firewall can make this mapping unusable.

Check the following before setup:

• Active Directory is reachable from the firewall, and DNS, time and routing are correct.
• Domain controllers record successful logon events.
• Windows clients are members of the domain.
• The firewall, Agents and Collectors can reach each other through stable, correctly configured IP addresses.
• Client Authentication is allowed for the affected zones under Administration > Device access > Authentication services > Clients. For details, see Device Access on Sophos Firewall.
• The service account, password changes and technical accounts for the Exclusion List are documented.

STAS 2.5 and later supports Windows Server 2008 R2, 2012 R2, 2016, 2019, 2022 and 2025, and installation on either a domain controller or in a documented member-server design. Nevertheless, old server versions should no longer be planned for new installations.

Agent, Collector and redundancy

The STA Agent reads AD logon events. The STA Collector processes the user-to-IP mappings and sends them to the firewall. In the traditional design, an Agent runs on every relevant domain controller; from STAS 2.5, a supported member server can point to the domain controller. One Agent can serve multiple Collectors, and one Collector can serve multiple firewalls.

In small environments, the SSO Suite can install the Agent and Collector on the same system. In production or larger environments, a separate Collector is often easier to monitor and generates less additional traffic on the domain controller.

A Collector group contains no more than five Collectors. The first is primary and the others act as backups. Collectors for the same domain belong in the same group; use separate groups for subdomains or separate domains.

RDS, Citrix and SATC

Traditional STAS cannot distinguish multiple users behind the same RDS, terminal server or Citrix IP. In this case, consider SATC through Sophos Server Protection; the former standalone legacy SATC client is no longer supported. When STAS and SATC run in parallel, add the affected server IPs to the STAS logon and logoff exclusions.

Ports and connectivity

The three core connections are straightforward:

Additional connections depend on the functions used:

For WMI or Registry Read Access, the corresponding RPC, RPC Locator, DCOM, WMI or Registry services must be reachable on the clients. Restrict Windows Firewall rules to the Collector IP addresses.

From the Collector, test the two TCP ports of a test client as follows:

Test-NetConnection -ComputerName 10.10.20.25 -Port 135
Test-NetConnection -ComputerName 10.10.20.25 -Port 445

TcpTestSucceeded : True confirms only the TCP path. The account, DCOM, WMI or Registry access must then be tested with WMI Verification or Registry Read Verification in STAS.

Prepare Active Directory

Enable logon events

On each domain controller with an STA Agent, open secpol.msc and go to:

Security Settings > Local Policies > Audit Policy

Open Audit account logon events.

Enable Success and Failure, then save the setting.

On Windows Server 2008 and later, Security Event ID 4768 is a quick indicator of a successful domain authentication that the STA Agent can capture.

Configure the STAS service account

Use a documented account for the STAS service. It does not have to be a Domain Admin, but depending on the design it requires:

• Domain Users and Event Log Readers on the domain controller
• read and write permissions for C:\Program Files (x86)\Sophos\Sophos Transparent Authentication Suite\
• Remote Desktop Users, Distributed COM Users, and WMI permissions for Root\CIMV2 with Execute Methods and Remote Enable on the endpoints
• the Log on as a service user right

Endpoint permissions can be distributed through Group Policy. If Workstation Polling is not used, do not grant unnecessarily broad permissions.

The user right is located under:

Security Settings > Local Policies > User Rights Assignment

Then add the STAS account.

Install and configure STAS

Check Active Directory on the firewall

A working Active Directory server must be configured under:

Authentication > Servers

Under Authentication > Services, set the AD server as the primary method for the relevant area. Connect Active Directory to Sophos Firewall explains the NetBIOS domain, search base, groups and connection test.

Download and installation

Download the installer here:

Authentication > Client downloads

Under Single Sign-on, click Sophos Transparent Authentication Suite (STAS).

Run STAS.exe as an administrator and install the Agent, Collector or SSO Suite according to the design.

With multiple domain controllers, each relevant domain controller normally requires an Agent. The currently distributed installer version is not publicly documented, so check it directly in the downloaded file.

General

On the General tab, enter the NetBIOS name, FQDN and service account. The NetBIOS name must be uppercase.

STA Agent

On the STA Agent tab:

• use EVENTLOG as the STA Agent Mode for local event log detection
• under Specify the networks to be monitored, enter only actual client networks in CIDR notation
• set Domain Controller IP only in a member-server design; leave the field empty when the SSO Suite runs directly on the domain controller
• add all intended Collectors to the Collector List

STA Collector

On the STA Collector tab:

• enter the reachable firewall IP addresses under Sophos appliances
• deliberately set Workstation Polling Method to WMI or Registry Read Access
• enable Enable Logoff Detection only when ping and polling suit the client network
• with STAS 2.5.1.0, set Dead entry timeout to 0 because of Known Issue NCL-1309; Sophos recommends WMI for Logoff Detection in this version

With HA, the Collector must reach the configured firewall IP over UDP 6060; the firewall needs the return path to the Collector over UDP 6677. Test user mapping separately after a failover.

Exclusion List

The Exclusion List should contain accounts that could overwrite normal user mappings:

• backup, monitoring, software distribution and endpoint accounts
• administration and installation accounts
• accounts that log on to many clients in the background
• systems on which no normal workstation users are expected

Without an Exclusion List, a service account on the same IP can displace the user from Live Users shortly after a real logon.

Enable STAS on the firewall

Under the following path, enable Enable Sophos Transparent Authentication Suite and select Activate STAS:

Authentication > STAS

Add each Collector with Collector IP, Collector port and Collector group. On the STA Suite General tab, the firewall must appear under Sophos appliances.

Then allow Client Authentication for every required zone under Administration > Device access > Authentication services > Clients.

The most important STAS values on the firewall are:

STAS quarantine drops inbound traffic when the Collector does not return a matching user and destination IP mapping. Enable user inactivity signs out users who do not transfer enough data within the defined period. Both options must suit the rule and client behaviour.

⚠️ SFOS 22: On SFOS 22.0 MR1 Build 490, Restrict client traffic during identity probe = Yes can cause repeated probes and traffic interruptions, and can block an upgrade or trigger a warning. No is the documented workaround. The Known Issues list identifies MR2 Build 546 as the fixed version; MR2 also changes the default to No. Check an existing value before and after the upgrade. Further blockers are covered in the SFOS 22 upgrade check.

User-based firewall rule

Only after a test user appears reliably in Live Users should you create a rule with the intended AD group and enable Log firewall traffic.

In Log Viewer, the username, group, rule ID and action must match expectations. General rule analysis is covered in Test a firewall rule with Log Viewer, Policy Tester and Packet Capture.

Verify and operate the setup

Test the entire chain in a controlled manner:

1. Log a test user on again at a domain client.
2. Check Security Event 4768 on the domain controller.
3. Check the STA Agent and STA Collector.
4. Open Advanced > Show live users in STAS.
5. Check Current activities > Live users on the firewall.
6. Test the user-based rule with real traffic and logging.
7. Test logoff, user switching and a technical account from the Exclusion List.

The local STAS tools are under Advanced > Troubleshooting:

• Test Connectivity > Sophos checks the firewall connection.
• Test Connectivity > STAS Agent checks Collector to Agent.
• Test Connectivity > STAS Collector checks Agent to Collector.
• STAS Polling Utilities > WMI Verification and Registry Read Verification test access to a client IP.

The log is available under Advanced > View Log and at the following location on the Windows system:

C:\Program Files (x86)\Sophos\Sophos Transparent Authentication Suite\stas.log

Before major changes, create a backup under Advanced > Backup / Restore > Backup Now. The file is named STAS_ConfigBackup_DD_MM_YYYY_THH_MM_SS.bkp and can be restored through Upload and Restore.

During operation, maintain the service account, Exclusion List, monitored networks and Windows Firewall GPOs. Repeat the end-to-end test after Windows, domain controller, STAS or firewall updates. If many user objects accumulate over the years, or only individual portal or VPN users fail, also check the Sophos Firewall user ID limit.

Troubleshooting

No users in Live Users

Check in this order:

1. Is Event ID 4768 generated on the domain controller?
2. Is the STA Agent running and monitoring the correct domain controller and client network?
3. Can the Agent reach the Collector over TCP 5566?
4. Do UDP 6060 and 6677 work between the Collector and firewall?
5. Is Client Authentication allowed for the client zone?
6. Does the firewall see the same client IP as STAS?

Endpoint security can also block STAS communication, and multiple NICs can lead to an incorrect STAS binding. If the Collector is behind an IPsec tunnel, system-generated firewall traffic may require an appropriate SNAT IP.

User is mapped incorrectly

Check whether a backup, monitoring, installation or administration account is overwriting the same client. Add the relevant account to the Exclusion List and repeat the test with a fresh user logon.

User disappears too quickly

With STAS 2.5.1.0, Dead entry timeout must be set to 0 because of NCL-1309. Then check Advanced > Show live users, stas.log, and WMI or Registry verification against the client.

DCOM errors or incorrect networks

Windows Events 10009 or 10028 often occur when the Collector queries unreachable systems. In this case:

1. On the STA Collector tab, edit the firewall under Sophos appliances.
2. Enable Enable subnet based filter and enter only actual client networks.
3. On the STA Agent tab, check the same networks under Specify the networks to be monitored.
4. Apply the changes, restart STAS and check stas.log again.

Users with LogonType: 1 from unmonitored networks indicate missing or unsuitable filtering. After correction, SSOclient_filter_CR_subnet: Workstation filtered out in stas.log confirms that STAS excluded a workstation as intended.

User rule does not match

Check whether the user appears in Live Users, the expected AD group is resolved, and Log Viewer shows the username rather than only the IP. Then check the rule position and any earlier fallback rule. Use the linked rule-testing article for further analysis.

Identity Probe and CTA transition period

When the firewall detects traffic from an unknown IP, it starts an Identity Probe. With Restrict client traffic during identity probe = Yes, traffic is blocked during the probe; with No, it continues. If the Collector does not respond, the firewall then treats the IP as unauthenticated for one hour and applies the relevant rules for unauthenticated traffic.

The following command displays the current CTA settings in option 4 of the Device Console:

system auth cta show

The separate Drop Period can be set from 1 to 120 seconds:

system auth cta unauth-traffic drop-period <1-120>

Example for 40 seconds:

system auth cta unauth-traffic drop-period 40

Values below 20 seconds can interrupt the learning process and redirect domain users to the Captive Portal. Change the value only with a documented test case, then check system auth cta show, Live Users and the affected client again. Clientless Users or separate rules are usually more appropriate for devices outside the domain.

STAS over VPN

STAS can detect branch users over an IPsec VPN with a domain controller at the main site. Routing, source IP and monitored networks must match. In the Sophos reference design, both firewalls are integrated into the STAS design; the domain controller can be located exclusively at the main site.

Requirements:

• The IPsec connection and routing through the tunnel work.
• The branch network is entered as a monitored network in the STA Agent.
• The branch firewall is configured under Sophos appliances in the STA Collector.
• Client Authentication is allowed for the VPN zone.

On the firewall at the main site, add the remote network in the Device Console:

system auth cta vpnzonenetwork add source-network 10.20.50.0 netmask 255.255.255.0

Replace the example network with the actual branch network, then test a fresh domain logon, Live Users and a logged user-based rule across the tunnel.