[9.090][ANSWERED] Endpoint Webfiltering

Hi,

I am trying Endpoint webfiltering.

Question: When a Laptop has enabled Endpoint Content filtering and is behind the UTM, are both UTM and Endpoint Client filtering the content?

There is an Advanced section, but the checkbox seems to be only for antivirus filtering.

Sven

Parents

0 AngeloC over 12 years ago

If you have endpoint protection and have enabled the new web content filtering for those endpoints, the client will do the filtering (albeit exactly how it looks in the UTM, just the execution is handled at the client level), and this is location agnostic, no matter where they are.

It is very slick and works quite well, give it a shot!
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 maygyver over 12 years ago in reply to AngeloC

I tried it, but what happens when the Laptop is back behind UTM? Double Content filtering?

Astaro user since 2001 - Astaro/Sophos Partner since 2008
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 12 years ago in reply to maygyver

As far as I can tell, yes, "double filtetring" if an endpoint has web filtering in the client enabled and the client ends up behind a UTM doing content filtering at the perimeter.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 BrucekConvergent over 12 years ago in reply to maygyver

As far as I can tell, yes, "double filtetring" if an endpoint has web filtering in the client enabled and the client ends up behind a UTM doing content filtering at the perimeter.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 maygyver over 12 years ago in reply to BrucekConvergent

It was just a config error. My Default Filter was not set to block and had been used.

This Feature is very powerful and finding error is not easy.

But double filtering will not be done, cause of sophosxl.net usage. Is it correct, that sophosxl.net is no contacted and this traffic is decoded internally by UTM Proxy?

Hi,

I tried it, there is no double filtering done.

But there is a big big bug.

I enabled Endpoint Content Filter. After that I have only sophosxl.net traffic from Endpoint Client. This traffic is allowed with an Exception by default.

What happens. When there is no content filter endpoint config, all traffic from endpoint is hidden, cause sophosxl.net URL is used and allowed by default.

This is a very bad thing, because Content filter is bypassed by every user who uses sophos endpoint Webfilter. This is even worse, when external user using sophos endpoint webfilter and are able to Bypass UTM Content filter.

Sven

Astaro user since 2001 - Astaro/Sophos Partner since 2008
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

[9.090][ANSWERED] Endpoint Webfiltering

Submitted a Tech Support Case lately from the Support Portal?