We are running Sophos UTM 9 and it appears to resolving many of our web requests by the users ip address and not their username resulting in the user getting a Default content filter action. Logs will appear as such: srcip="xx.***.x.xx" dstip="" user="" statuscode="401" cached="0" profile="REF_HttProInternal (Internal)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)".
I can't have this affecting our users set policy like this.
Also many of the reports show only client IP's and not their usernames. How can I pull reliable reports if Sophos logs by username as well by IP and they both display different data.
Any thoughts anyone?
This thread was automatically locked due to age.
