Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 27 subscribers
  • Views 5541 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Web Filters prompting for authentication (if DNS does not resolve?)

DavidRa

I have a new XG implemented as a replacement of an SG. One of the features I was most looking forward to reimplementing was web filtering - primarily for control of ads, malware and spam URLs etc.

I have the XG default web browsing policy configured at the bottom of my firewall policy list. In it, I have made a couple of minor changes - basically adding a trusted download site list for http-based downloads for a group of users.

If I (re)apply this web policy to the (last) firewall rule "#Default_Network_Policy" - which I haven't yet renamed - and then I browse to a website that has links to something like addthis.com (which isn't resolving - and this may be the key to this puzzle?) I get authentication prompts for the site's URLs. No other web policies are applied to any firewall rules.

For example:

http://s7.addthis.com/static/sh.7a295a410262af12dfaaa96a.html

attempts to load some JSON from

http://m.addthis.com/live/red_lojson/100eng.json?REDACTED

which pushes me to

XGIPADDRESS:8091/ntlmauth.html

As I type this, 1m.addthis.com is not resolving:

So first ... is my hypothesis right, does web filtering throw to authentication if DNS doesn't resolve? Can I stop that? Or have I screwed something up?



This thread was automatically locked due to age.
  • 0

    Go to Authentication, Services, and at the bottom change "Prompt unauthenticated users to log in" to No.

     

    At issue is that some people have a policy that says...  anyone unauthenticated can visit some sites, but only the IT department can visit Shopping sites, everyone else is blocked.  So you can browse around unauthenticated but as soon as you go to a shopping site it says "I need to know who you really are before I know if you are blocked.".

    If you are using NTLM, it tries to do an NTLM login (which is what appears to be in your case) and after it knows the user it will give you a block page.

    If you are not using NTLM, it will display a block page with a hyperlink to the captive portal.

  • 0 in reply to Michael Dunn 
    I also have the same case when accessing via sophos proxy after 5-10 minutes appear ntlm authentication page.