Error: IWA health check failures after upgrade to SGOS 7.4.14 and enabling "optimize-dc" feature

Products

• ISG Proxy
• ProxySG Software - SGOS

Issue/Introduction

After upgrading to SGOS 7.4.14 and later, an increased number of IWA health check failures occur. This issue appears after enabling the optimize-dc feature, resulting in "sick" status alerts,  AUTH_EVENT_SCHANNEL_DC_CONNECTED log spam, and Schannel Resets.

Environment

• Product: Edge SWG (ProxySG)
• Version: 7.4.14
• Feature: IWA Direct Authentication with optimize-dc enabled

Cause

A defect in the optimize-dc feature causes a session key overwrite. When the appliance tests the currently connected DC, it instantiates a new connection. This overwrites the active Schannel session key for the machine account, invalidating the session key held by the primary server handling live NTLM authentications .

Resolution

Resolution

This issue is confirmed as a product defect.

Workaround: If upgrading to SGOS 7.4.14.3, use one of the following methods to mitigate the issue:

• Keep the optimize-dc feature disabled.

Fix Status: Targeted to be fixed in a future SGOS release. Subscribe to this article (reference: KB 275360) to receive updates on the fix status.