Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 11 replies
  • Subscribers 30 subscribers
  • Views 2183 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Security Features > Web Filtering - Best pracise for BYOD Devices

Daniel Hargrove

Hi.

I am looking for some advise around the best practise for Web Filtering for a BYOD network. 

We have a seperate network setup on our XG for residents who connect their own devices which are mainly mobile devices. We have a firewall rule crated to allow this dedicated zone out on the internet and in this rule I want to setup Web Filtering. I have created a Web Policy which includes a large amount of categories to block but I am unsure which of the other settings under this feature to enable or disable. These settings are shown as: 

Web Policy: 
Apply web category-based traffic shaping (currently disabled) 
Block QUC propocol (currently enalbed) 

Malware and contect scanning 
Scan HTTP and decrypt HTTPS (currently disabled) 
Use zero-day protection (currently disabled) 
Scan FTP for malware (currently enabled) 

Filtering common web ports 
Use web proxy instead of DPI engine (currently enabled) 

Web Proxy Options 
Decrypt HTTPS during web proxy filtering (currently disabled) 

I have SSL / TLS Inspection enabled but I read somewhere about a certificate being needed to allow this to work correctly. 

On the same XG we do have a corporate network which is setup against a different firewall rule and I plan to setup SSL and TLS inpection against this. 

With the testing I have done on the residents network I have found internet browsing to be slow which may be down to the amount of categories I have selected. As this is a residents network I need to make sure a solid level of proteciton is in place and I would like secure sites to be scanned as most sites have a certificate in place. 

Any guidance would be greatly apprecaited. 

Many thanks, Dan 



This thread was automatically locked due to age.
  • 0 in reply to Prism

    The super descriptive wording would be.

    "Scan HTTP and decrypted HTTPS traffic"
    Perform antivirus scan on any traffic that it can.  What traffic it can depends on all the other settings.  For example, only traffic on ports listed in Services can be scanned.  HTTP can be scanned.  HTTPS can be scanned only if you also have rules that decrypt the traffic.
    This option does not start turn on decryption.  It turns on malware scanning of traffic that is decrypted (because other settings have made it decrypted).


    "Filtering common web ports [ ] Use web proxy instead of DPI engine"
    The DPI Engine can scan traffic/apply policy on any port.  The Web proxy can only scan/apply on port 80/443 ("common web ports").
    Traffic on port 80/443 will use this setting to determine whether proxy/DPI should be used.
    If ports are listed in Services but are not 80/443 then they will be done by DPI regardless of this setting.

    If you are using port 80/443 and you are using the web proxy, then the "Decrypt HTPS during web proxy filtering" will be used to decide whether to decrypt traffic.
    If you are using port 80/443 and you are using the DPI mode, then the SSL/TLS rules will be used to decide whether to decrypt traffic.
    If you are using other ports then you must be using DPI mode, and the SSL/TLS rules will be used to decide whether to decrypt traffic.

    https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/115976/sophos-xg-firewall-v18-xstream---the-new-dpi-engine-for-web-proxy-explained
    https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/121482/https-decrypt-and-scan-faq

Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?