Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 5 subscribers
  • Views 3621 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos UTM 9.4 question

StephenHill

Want to better understand Standard  v. Transparent mode.

 

In particular, am informed via support calls that to have reporting identify the userid (rather that the proxy address itself or device names) it is a requirement to be running in Transparent mode and with AD SSO operating mode.

 

But Standard mode also has AD SSO operating mode as an option, so what is it is about Transparent mode that makes the difference.

 



This thread was automatically locked due to age.
Parents
  • 0

    Hi Stephen.

    AFAIK, transparent mode captures HTTP and HTTPS packets and diverts it to the proxy automatically. On Standard mode you need to tell your endpoint to connect through a proxy by using wpad.dat (automatic proxy configuration) or manual proxy configuration, otherwise machines will not "know" they need to authenticate to a proxy and will fall into the default web protection policy. 

    Back in the day, transparent proxy was only available with Browser on Agent authentication due to the way endpoints handles proxy authentication, so the only way to have AD SSO was to use standard mode. Sophos then introduced Transparent AD SSO as a way for having the best of both worlds: a proxy on which no endpoint configuration is required AND works with AD SSO. It has some caveats during setup, but once it's working, it's beautiful.

    As for your question, both modes will provide you Web Protection reporting with usernames instead of IP addresses. If you manage to setup Transparent AD SSO, I'd stick with that. It's a bit tougher to get it working, but it will save you a lot of issues and effort in the future.

    If you are looking for a layer 8 experience, you should check STAS: https://www.sophos.com/en-us/medialibrary/PDFs/documentation/STAS_manual-en.pdf?la=en. I'm still testing it on my lab and it still has some issues but, for the long run, it should make any sysadmin life a lot easier. In a nutshell, with STAS you would not need to worry about authentication anymore, since it would authenticate users using their logon information on the Domain Controller AND you would be able to create firewall, QOS and application control rules based on usernames instead of IPs, as the agent would also match usernames to their endpoint IP addresses. 

    Regards - Giovani

Reply
  • 0

    Hi Stephen.

    AFAIK, transparent mode captures HTTP and HTTPS packets and diverts it to the proxy automatically. On Standard mode you need to tell your endpoint to connect through a proxy by using wpad.dat (automatic proxy configuration) or manual proxy configuration, otherwise machines will not "know" they need to authenticate to a proxy and will fall into the default web protection policy. 

    Back in the day, transparent proxy was only available with Browser on Agent authentication due to the way endpoints handles proxy authentication, so the only way to have AD SSO was to use standard mode. Sophos then introduced Transparent AD SSO as a way for having the best of both worlds: a proxy on which no endpoint configuration is required AND works with AD SSO. It has some caveats during setup, but once it's working, it's beautiful.

    As for your question, both modes will provide you Web Protection reporting with usernames instead of IP addresses. If you manage to setup Transparent AD SSO, I'd stick with that. It's a bit tougher to get it working, but it will save you a lot of issues and effort in the future.

    If you are looking for a layer 8 experience, you should check STAS: https://www.sophos.com/en-us/medialibrary/PDFs/documentation/STAS_manual-en.pdf?la=en. I'm still testing it on my lab and it still has some issues but, for the long run, it should make any sysadmin life a lot easier. In a nutshell, with STAS you would not need to worry about authentication anymore, since it would authenticate users using their logon information on the Domain Controller AND you would be able to create firewall, QOS and application control rules based on usernames instead of IPs, as the agent would also match usernames to their endpoint IP addresses. 

    Regards - Giovani

Children