Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 8 replies
  • Answers 1 answer
  • Subscribers 5 subscribers
  • Views 11061 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Dynamic AD group for computers to be able to access limited internet???

GarryGalon1

OK, here is my dilemma. 

I have my AD setup the way I want. When I do Lite Touch, and Zero Touch deployments with my MDT servers, the tasks place the computers in specific OUs based on the role the computer deployed is going to do. I have GPOs that apply very specific settings to these computers. What I want to do, is have my Sophos UTM 9.5.xxx read the AD group memberships so that specific computers belonging to specific AD groups are automatically added to groups on the UTM which allow the different groups access to different websites, whilst locking others down to only access certain websites, etc. The AD side of everything via GPOs is working perfectly. The computers get deployed, and all of their settings AD wise get sorted out, added to the computer groups in AD I want, but when it comes to the Sophos side of things, it doesn't work. I can't for the life of me get Sophos to pickup on these specific AD groups (They are computer groups not user groups), and automatically add them to the specific Sophos groups, and thus allow them to get out to the net where I need them to be able to go. As it stands right now, I have to manually add the computers to groups in Sophos via (Network Definitions --> Network Group membership), and then they work as they should based on the Sophos rules I have placed on those groups. But with a fairly massive refresh / re-certification project about to kick off soon, I'd like to have this all working seamlessly with zero input needed by the Sophos Admin. Does anyone have any ideas or suggestions on how to go about this?



This thread was automatically locked due to age.
Parents
  • 0

    As oldeda has observed, the problem is that UTM never identifies the computer entity as a person object, so it never looks for group membership associated with it.

    What I can suggest to help you with your goal:

    • Create UTM host (static ip) or DNS Host (DHCP) objects for each computer, or create network range objects if your groups align with network ranges.
    • Put the PC objects and network range objects into UTM network group objects.
    • Create a Web Proxy Filter Profile for each of your logical groups, and assign the appropriate network group object to the"Allowed Networks" list of the Filter Profile.
    • Within a Filter Profile, you can still configure user-dependent policies to further refine your allow/block rules.

    I assume that you will want to catch all traffic, so you will use either Transparent Mode by itself, or Standard+Transparent together, plus firewall rules.  My testing indicates that a PC will be doing some web traffic even when no one is logged in, so you should have an unauthenticated users option in Transparent Mode which allows baseline traffic.   It will take some digging to determine what to include in the baseline traffic.  My testing also indicates that the best way to separate browser traffic from other stuff is to use both proxy modes.   My list of "other" stuff includes AntiVirus software, GoToMyPC-type software, Automatic updates of all types (java, adobe, windows, PC-vendor drivers), and fat-client applications specific to your industry.

    Most large-company websites import content from many seemingly-unrelated sources.  If you allow the main page but block a critical component, the page may be rendered very poorly.   Splitting the internet into the "partitions that we need" and the "partition that we do not need" has proven to be very tricky for us.  You need to have good log analysis tools once you start blocking things.   See my post about using SQL to parse UTM logs.

    Also, depending on how many PCs and logical groups, your strategy could become difficult to manage -- but it can be done.

     

Reply
  • 0

    As oldeda has observed, the problem is that UTM never identifies the computer entity as a person object, so it never looks for group membership associated with it.

    What I can suggest to help you with your goal:

    • Create UTM host (static ip) or DNS Host (DHCP) objects for each computer, or create network range objects if your groups align with network ranges.
    • Put the PC objects and network range objects into UTM network group objects.
    • Create a Web Proxy Filter Profile for each of your logical groups, and assign the appropriate network group object to the"Allowed Networks" list of the Filter Profile.
    • Within a Filter Profile, you can still configure user-dependent policies to further refine your allow/block rules.

    I assume that you will want to catch all traffic, so you will use either Transparent Mode by itself, or Standard+Transparent together, plus firewall rules.  My testing indicates that a PC will be doing some web traffic even when no one is logged in, so you should have an unauthenticated users option in Transparent Mode which allows baseline traffic.   It will take some digging to determine what to include in the baseline traffic.  My testing also indicates that the best way to separate browser traffic from other stuff is to use both proxy modes.   My list of "other" stuff includes AntiVirus software, GoToMyPC-type software, Automatic updates of all types (java, adobe, windows, PC-vendor drivers), and fat-client applications specific to your industry.

    Most large-company websites import content from many seemingly-unrelated sources.  If you allow the main page but block a critical component, the page may be rendered very poorly.   Splitting the internet into the "partitions that we need" and the "partition that we do not need" has proven to be very tricky for us.  You need to have good log analysis tools once you start blocking things.   See my post about using SQL to parse UTM logs.

    Also, depending on how many PCs and logical groups, your strategy could become difficult to manage -- but it can be done.

     

Children
No Data
Unfiltered HTML