This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to configure web filter profiles with AD SSO correctly?

Hi @ all,

I'm stuck while configuring the web filter. Hope s/o can help me. Here's what I did 'til now:

1. created own URL Filtering categories
2. marked them on tab "URL filtering" (block these categories)
3. on webfilter profiles -> Filter action: modified the default content filter block action to block all security issues (e.g. spam..)
4. created additional filter actions: Filter.SocialNetworking; Filter.unwanted; Filter.Webmail
all with the created categories.

5. Filter Assignments -> created the needed assignements for the created filter actions
(Question: If I add a user/group here, this one will bypass the assignment. Right?)

6. Proxy-Profile -> created WFP.webmail with filter assignment FA.webmail, default content filter block action, standard mode, AD SSO für internal bridged (BrLAN) network.

==Result: Is working

7. created another proxy-profile (2), at position 1

==Result: proxy-profile (2) is working. The first doesn't work anymore.

8. Test: combined the 2 FA to one rule

==Result: only the first in order is used.

Basic configuration was done following THIS Article

(Just edited all AD-Groups from DN to simple Group name)

What I want to archive:
Have several filter profiles assigned to different users/AD Groups, while a user might be in more than one group. With the basic setting in our ASG future configuration can be done by adding users to the appropriate AD-group.

Hope you understand the problem and the goal. Can s/o give me some hints on how to accomplish this?

Thanks in advance!

LoD

This thread was automatically locked due to age.

0 BAlfson over 13 years ago
LoD, please [Go Advanced] below and show a picture of the combined Profile that's not working.

Have several filter profiles assigned to different users/AD Groups, while a user might be in more than one group.

Just remember that order matters:
The selection of which profile applies depends on the user's IP address and the profile's Operation and Authentication modes.
Once an access qualifies for a Profile, no further Profiles are considered.
Inside a Profile, once an access qualifies for a Filter Assignment, no further Filter Assignments are considered.

Cheers - Bob
PS Also, please show a picture of one of the Filter Assignments.
Cancel
Vote Up 0 Vote Down

Cancel
0 LoD over 13 years ago in reply to BAlfson

Hi Bob,

I'm not sure if I understood your description of the orders:

I guess in many companies there will only be one subnet at all. And of course every user has one PC with one ip-address asigned.

So if a user / a user's ip matches the first rule, no more rules will be applied? Am I right? Then this would mean, independend on how many rules are given, every user will only be affected by one rule ?! [:S]

I assume, no I know, there's a way. Everything else wouldn't make sence, would it?

So here are two pictures...
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 13 years ago
I wish it worked in the way you have it set up - in fact, I suggested something very close to that two years ago, and Gert implied that they would consider my proposal the next time they completely re-write the Web Proxy.

The only Filter Assignment in your WFP.SocialNetworks Profile that would ever be used is the first one, FA.webmail.

In general, you can use one Profile for each internal subnet. So, for example, if managers' PCs were given static DHCP assignments in the 172.20.1.112/28 range and everyone else had dynamic IPs assigned in the 172.20.1.128/25 range, you could make separate Profiles for each of those subnets.

In fact, you probably only want one Profile. That means you should consider each group of people and what you want to allow them to do. If part of a group should have more or less access, the group must be separated into two groups. Once you have the groups and accesses defined:
Create a Security Group in AD for each group of people and assign each user to one of these groups.
Create a Backend Goup in Astaro for each AD Security Group.
Create a Filter Action in Web Security corresponding to the accesses allowed to each group.
Create a single Filter Assignment for each group assigning to the appropriate Backend Group the Filter Action created for the group.

Cheers - Bob
PS That Sophos KnowledgeBase article you linked to in Post #1 is one that I wrote over three years ago and updated to V8.3 not long before it was moved from the Astaro wiki-based KnowledgeBase.
Cancel
Vote Up 0 Vote Down

Cancel
0 LoD over 13 years ago in reply to BAlfson

Thank you very much Bob.

That's very annoying. I would never have expected that such a feature-packed device cannot manage to assign filter to groups in one network.

What about V9 (didn't test it yet). Is that a complete re-design of the web proxy? Does a feature request already exist for this?

Back to my desired solution: Creating subnets making the network structure more complex isn't a solution here. So I'll try to solve this with one profile. (By the way: Is the web profile part dedicated to larger companies with more complex network structures an several subnets only?)

So I will have to put one Filter Assignment with everything to be blocked into one profile and e.g. except facebook-users from that profile.

1. creating AD-sec Group: "facebookusers" with employees allowed to use it
2. creating a BE-group "ad.facebookusers" with the above AD-group
3. creating a filter action blocking facebook
4. creating a filter assignment blocking everythin unwanted with ad.facebookusers allowed

Right? But: If in this profile there's also a filter for anonymizers defined, the 'facebook-users' will also be able to use them?
Or did I miss something?

PS That Sophos KnowledgeBase article you linked to in Post #1 is one that I wrote over three years ago and updated to V8.3 not long before it was moved from the Astaro wiki-based KnowledgeBase.

I know :-) Found it again while searching for a solution.

greetings
LoD
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 13 years ago

Yes, do your four steps and put that Filter Assignment into a Profile that uses AD-SSO with "Default filter action" as the 'Fallback action'.

In the 'Web Filtering' section, this "Default filter action" is defined, and you'll want to configure those tabs identically to the Profile but blocking Facebook. The other difference (this doesn't affect logged-in users because they are handled by the Profile) is on the 'Global' tab where you want all of your internal networks, "Transparent" mode and 'Authentication: Browser'.

I didn't understand the question about anonymizers, but I think anonymizers should always be blocked.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 LoD over 13 years ago in reply to BAlfson

Hi Bob,
thanks so far. I'm getting closer :-)

I'll attach the actual settings. Problem is: Although there's an exception for the user group in case, also these users cannot browse e.g. facebook.

Would you please take a look at it?

I didn't understand the question about anonymizers, but I think anonymizers should always be blocked.

Maybe the matter has resolved itself because of you explanation and the other way of filtering now? I'll test. I was in fear that if there are more categories blocked and an exception is made for a specific user group to access one category , this group will also gain access to other categories.... Hmmm, I'll test it again

Edit: With the settings attached all unwanted categories are blocked. But:The exception for the group "UG.jim.GF.IT.Prokura" isn't working. Override does but is not the prefered way. [:(]
Webfilter protocol: filteraction="REF_DefaultHTTPCFFBlockAction (Default content filter block action)" So the profile isn't used. But why?

Thnx and greetings

LoD
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 13 years ago

It's difficult to follow some of this because the "Default content filter block action" has been modified. Normally, that's used to block everything, so someone coming in to help has to take time to figure out what's not "standard" before being able to understand what's going on.

In the Profile, the 'Fallback action' (Ersatzaktion) should be "Default filter action" and not the "block" action.

I suspect the full line from the log would show that the WFP.All profile was selected as the "Default content filter block action" isn't otherwise selected.

Are you getting the results you want now?

Cheers - Bob
PS Using an Exception is another way to to accomplish what you want without using a Profile. You could make an Exception that allows one or more backend groups free access to ^https?://[A-Za-z0-9.-]*facebook\.com and ^https?://[A-Za-z0-9.-]*fbcdn\.net. Of course, if you don't use a Standard/AD-SSO Profile, you'll need to select that on the 'Global' tab instead of "Transparent" mode.
Cancel
Vote Up 0 Vote Down

Cancel
0 LoD over 13 years ago in reply to BAlfson

Thanks again, Bob

I think, the best would be to set everything to default, leaving the default action as block all.

I'll give it a try. Is there a way to reset just these settings or some link to look them up?

Regards
LoD
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 13 years ago
I would just:
rename the 'Default content filter block action' to "IT Prokura filter action"
in "IT Prokura filter action', add ^https?://[A-Za-z0-9.-]*facebook\.com and
^https?://[A-Za-z0-9.-]*fbcdn\.net to 'Always allow these URLs/sites'
change the "WFP.All" Profile to have 'Ersatzaktion: Default filter action'

Does it work like you want now?

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 LoD over 13 years ago in reply to BAlfson
Hi Bob and thanks a lot.

Unfortunately it's not working:
The "Default Content Filter Block Action" is renamed and now has all unwanted categories (Social networking, webmailer, gmx and more) + the two exceptions mentioned by you.

The Filter Assignment WFA.All has the "IT Prokura Filter Action" and no users which it applies to.

The Profile wfp.all has the filter assignment WFA.All + Fallback 'Default Filter Action'

Although there are no users assigned to WFA.All I can surf facebook but can't reach gmx.de. I expected it to also block facebook, as I'm not one of the 'allowed users/groups' in filter assignments.

Shouldn't it work like that?

The webfilter protocol shows:
statuscode="304" cached="0" profile="REF_HttProWfpall (WFP.All)" filteraction="REF_DefaultHTTPCFFBlockAction (IT Prokura Filter Action)"

for gmx but also for facebook.

Seems there's still someting wrong with my configuration. Hope you'll help me solving this problem.

Thanks and greetings
LoD
Cancel
Vote Up 0 Vote Down

Cancel