Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 11 replies
  • Answers 3 answers
  • Subscribers 28 subscribers
  • Views 1301 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Create Exception for Webproxy Authentication

seroal

Hello,

I need to create a authentication exception in XG for the webproxy. There is one internet rule, that is applying a webpolicy, this rule requires authentication. Additionally in the webpolices, users are also configured. Webproxy configured within internet settings on the clients. In UTM this is possible with creating an Webproxy Exception. Nothing more needs to be done. In XG, when all Exceptions are selected, there is still an authentication site displayed. Is it necessary to create a separate firewall for that? Or how can this be achieved?

Thank you.



This thread was automatically locked due to age.

Top Replies

  • in reply to seroal +1 suggested

    Hey seroal,

    Thank you for quick information, try using the following URL pattern matches: 
    ^([A-Za-z0-9.-]*\.)?web\.de/
    ^([A-Za-z0-9.-]*\.)?web\.de/consent-management/
    =================================================
    The site falls under the category of Portal sites > so ensure under the web policy used it does not conflict in the web policy rules. 

    And are you using web base authentication i.e., captive portal ? 
    Then leave the  "Match known users." & "Use web authentication for unknown users" option enabled with mentioned users or groups. 

    Also ensure a plain FW rule is created with only DNS service allowed without any  "Match known users." & "Use web authentication for unknown users" option enabled or any web, application or IPS policy applied - keep that to none. 

    Jump to answer
  • 0 in reply to seroal

    Move away from the old Proxy and go to DPI Engine. 

    On UTM, you did authentication only for Web Traffic (due the lack of integration). So in UTM you did this only for the web proxy and http/s.

    In SFOS you can do it for every port. Therefore you can do the authentication with STAS, Endpoint etc. So you cannot workaround this kind of authentication, as the part of "which website do you try to get", is to late. The firewall already knows the authentication for this website. 

    Then do the DPI (decryption) and proxy with the firewall rule. 

    So get the authentication for the Client A, then you do not have to worry about "I do not want to auth for this particular website". Instead you can allow the access with the web protection rules. 

    In the end, why do you want to create such a Exception at all? Why did you do this on UTM? 

    __________________________________________________________________________________________________________________