Which Webfilter?

[seawolf]

Just searched for distributors of iboss int he UK and they are rather non-existant. 2 exist, 1 has a website was 1992 and the other doesn't have one.

 

One is alsoa PO box only address. Worrying if you want support on a product.

 

Well, there are zero distributors of iBoss in Australia, but I requested a demo unit and they sent me one within a week for a 90 trial. Turned out they just sent out a brand new unit and after two weeks of testing I decided to buy the unit they sent for the trial. The support provided for setup and configuration was excellent even though it was remote support. I was given the name and direct number for a tech as iBoss provide 90 days implementation/configuration support. They remoted in and walked me through everything. They really knew their stuff and weren't just some kid reading from a script.

 

Now, two years later I did have a hardware problem with my iBoss (seemed to be the NIC). Again, the remote support was great and when they identified that it was a hardware problem, Phantom shipped a brand new unit to me and it arrived in 3 days (from California to Australia). They didn't even want me to ship back the old unit (I asked) because of the expense of shipping it. Yes, there are no distributors here, but I can't complain about support!

 

Now, I am currently trying to convince one of my best suppliers to become an iBoss distributor because yes it would nice if there were local contacts over here. However, the iBoss was that much better than every other solution that it didn't really concern me that much. Many of their appliances are sub $2,000 or just over (we have 3550 unit and it was just under 2k) and subscription costs work out to $6 per student per year.

[Paid_Peanuts]

I'm in the process of investigating an alternative to our LEA connection and the current offering from VMB includes a Palo Alto PA500. A layer 7 firewall including web filtering. Which means when I lose the ability to use a virtual Smoothwall appliance when we pull away from the LEA I can use the PA500 to do the filtering the Smoothie did.

[Oaktech]

I'm in the process of investigating an alternative to our LEA connection and the current offering from VMB includes a Palo Alto PA500. A layer 7 firewall including web filtering. Which means when I lose the ability to use a virtual Smoothwall appliance when we pull away from the LEA I can use the PA500 to do the filtering the Smoothie did.

 

Don't do it.. . Not with a pa500, they are horrid. The hardware isn't good enough. They take ages to commit new settings we had one on trial and it took 20 minutes every time we added a rule. If you can stretch to a 3020 its a far better unit. The 20 series, is better than the 500, but the 30 series is even better.

[Paid_Peanuts]

Unfortunately the price they have quoted us for the 2020 unit is an additional 4k a year over a 3 year contract. I'd hate to think how much more the 3020 would be..?

[Oaktech]

That sounds like a lot. I'll pm you on Monday with the deal we get from Gamma. We had to push hard for it, but it soundsa lot better than you're being offered.

[Paid_Peanuts]

Great, thank you!

VMB annual rental includes this PA500. 100mb sync connection £9k per year with a 3k install = 30k over 3 years.

Little head room to buy anything else on top of those costs.

[Jobos]

Hi,

 

just reading this thread, Lightspeed sounds interesting.

could anybody pm me any prices that you would expect to pay please? and any personal experiences.

 

Thankyou

 

Jamie

 

Yes I would be interested in the price as well please. Our ISPs filter is pain to get anything unblocked so would love to move to in house filtering.

[Paid_Peanuts]

Oaktech how large is your organisation?

We have approx 1000 devices and 1500 users.

Just curious to know how many your 3020 is serving?

 

having looked at the quote again over 3 years a PA-2020 would cost us an additional 15,000 pounds over the cost of a PA-500.

Edited November 30, 2013 by Paid_Peanuts

[Oaktech]

We are 3 schools in a federation. We are approx 1500 domain devices, about 2500 users, plus at any one time, 120 byod on a guest network. We chose a 3020 as we have a gig sync pipe and the 3020 has full gig throughput.

[Achandler]

Thanks seawolf, I might investigate iBoss even more.

[Roberto]

We have just had a quote for 10k for smoothwall and thats without their hardware. We used RM Smart Cache before which was wasn't good but cost £490 pa. Its going to be a hard task pursuading the governors to stump up that much more!

 

Presumably, if the governors don't want to spend that much, they know of a suitable alternative? Obviously its a part of all our jobs to ensure that our respective institutions get good value for money out of their IT spend, so I'm not suggesting money should ever be spent rashly, but equally, the leadership in schools needs to realise that if they want/need good quality IT tools then these have a corresponding cost attached to them.

[CyberNerd]

@jamiet1985 @Jobos

 

The lightspeed cost is approx £3 per user per year on a 3yr deal plus the cost of the appliance plus what ever your re-seller adds.

[dave.81]

We've been using Smoothwall for years but will be carrying out testing of others next term before our renewal so this threat is very interesting. Would like to move to an appliance over buying in our own server to run our filtering, if money allows that is. Smoothwall, Censornet, Lightspeed, Sophos and iboss all on testing list at present.

[EmperorPeng]

We use BLOXX. It's fairly expensive at around £3K per year, but for ease of use and featureset I can't complain, and it has completely killed ALL anonymous proxy use. The pupils hate it!

[bodminman]

Lightspeed all the way for me. 4k'ish + vat for 3 years was a no brainer!

[jcookhgs]

Some useful info here. Will be starting to look at these solutions in the New Year, particularly SW and LS. Looking for an all in one solution to replace our current squid based system and the threat of ipads looming! They are on my BETT hit list for Jan.

[mtillbrook]

We have been supporting Sophos web appliances in 48 schools in one local borough for over 3 years now and find them to be fantastic. I would always recommend them for anyone!

 

You have to license them and then purchase hardware appliances but, if you have a VM infrastructure in place, you just need the license and they will send you a VM image you can run!

 

The integrate perfectly in AD and work like a charm!

[CyberNerd]

This is the evaluation of Lightspeed vs Smoothwall that I sent to the senior leadership team:

 

 

We are currently using a mixture of a commercial product called Smoothwall and an open source product called Dansguardian. The shortcomings that we have experienced with these systems are: speed, ease of use (for staff/students) and support.

 

We looked at similar systems including Bloxx and Lightspeed. Bloxx is rather expensive and quite limited. We were impressed by Lightspeed as it fulfilled the shortcomings that we experience with smoothwall. We entered into a 4 week trial of lightspeed in mid November. During this trial we also spoke with other schools using lighspeed.

 

Although we were impressed with many aspects of Lightspeed we found a design flaw: The system relies heavily on software that is installed on each laptop/telephone/PC/mac/tablet. The problem that this presents is that the company must keep the product updated for every version of laptop/telephone/PC/mac/tablet that we use. From experience of using the product we do not believe they are able to keep their product updated for multiple devices. We found significant issues with the software when using Citrix and the laptops in the Library (linux). We heard of further issues with ipads and we would expect more issues when manufacturers of tablets etc update their products.

 

Following this experience we took another look at Smoothwall: The physical machines that we use for Smoothwall are due to be replaced and they do not cope well with the potential 1100 devices that we have in school. We are hopeful/confident that replacing these servers and using the latest version of Smoothwall will alleviate these problems. We had previously budgeted to do this. We have also investigated simplifying the process of staff/students using Smoothwall. We are now confident that we can use a system called Web Cache Configuration Protocol (WCCP). WCCP means that staff/students will not need to enter any proxy settings into their devices because the content filtering will be transparent.

 

Although we are still concerned about the level of support we receive from smoothwall we have decided to continue using the system as we are confident that we can support it in-house. We have purchased a dedicated machine for this purpose and we intend on signing a three year contract in June 2014.

[seawolf]

This is the evaluation of Lightspeed vs Smoothwall that I sent to the senior leadership team:

 

Although we were impressed with many aspects of Lightspeed we found a design flaw: The system relies heavily on software that is installed on each laptop/telephone/PC/mac/tablet. The problem that this presents is that the company must keep the product updated for every version of laptop/telephone/PC/mac/tablet that we use. From experience of using the product we do not believe they are able to keep their product updated for multiple devices. We found significant issues with the software when using Citrix and the laptops in the Library (linux). We heard of further issues with ipads and we would expect more issues when manufacturers of tablets etc update their products.

 

This is another reason the iBoss 3550 has been a winner for us. It supports the following authentication methods:

 

• Active Directory, LDAP, eDirectory, Open Directory, and OpenLDAP

• Transparent Single Sign-on for Active Directory using server-side plugin, proxy, or NTLM

• Mac OSX logon/logoff scripts (controlled server side)

• Real-Time Directory Server Sync

• Individual User Login Creation (SuperUser)

- Web portal capture page for BYOD devices

- Mobile agent can also be installed on laptops if desired

 

We are using the AD plugin installed on our AD servers and Mac logon/logoff scripts - both work very reliably. The iBoss works seamlessly for Mac, Windows, or Linux. We are also able to set default filtering for our WiFi VLANs for iPad filtering and you can use the capture portal page with mobile devices as well. Additionally, iBoss has the MobilEther solution for MDM and filtering that will follow the device wherever it goes.

 

I make not a single dime from telling you this because there is not a single distributor for the iBoss in all of Australia - I have never seen any web filter even approach the functionality of the iBoss, and they are fantastic value at twice the price for what they are capable of doing. I don't care what you are using, the iBoss is worth a look.

[mac_shinobi]

I recommend Phantom iBoss 100% over every other web filter I've used, including SW, iPrism, and Watchguard. In the past three years I've had a couple of vendors come trying to sell me their solution. Then, I show them what the iBoss can do and they soon realize they are the Goliath that has met their David with no hope of matching the iBoss even for 10 times the price. Yes, the SmoothWall is usually cheaper than the iBoss, but I see tons of techs on here stuffing around with their SW trying to figure out how to get it to do things the iBoss does out of the box with its eyes closed.

 

Can't comment on the LightSpeed unit one way or the other as I haven't touched it, but you should trial both the LightSpeed and iBoss before deciding. I would be really surprised if the LightSpeed beat it. If it does, let me know and I'll look at it myself if it's THAT good.

 

Maybe you could do a video to show us what the gui is like, features you can easily setup out the box etc

[seawolf]

Maybe you could do a video to show us what the gui is like, features you can easily setup out the box etc

 

Good idea. I might do that this summer after I get through my big list of projects. We're three days from the end of the school year here so it's pretty busy now and for the next couple of weeks until Christmas.

[texdiver]

New here. I use iBoss also. I agree with seawolf. I have been using it for about 2 years. Youtube has a few videos that show basic setup but there is so much more it can do. it is a very powerful unit. that is my opinion only. I also do not get paid for this.

[Eappariello]

This is the evaluation of Lightspeed vs Smoothwall that I sent to the senior leadership team:

 

 

We are currently using a mixture of a commercial product called Smoothwall and an open source product called Dansguardian. The shortcomings that we have experienced with these systems are: speed, ease of use (for staff/students) and support.

 

We looked at similar systems including Bloxx and Lightspeed. Bloxx is rather expensive and quite limited. We were impressed by Lightspeed as it fulfilled the shortcomings that we experience with smoothwall. We entered into a 4 week trial of lightspeed in mid November. During this trial we also spoke with other schools using lighspeed.

 

Although we were impressed with many aspects of Lightspeed we found a design flaw: The system relies heavily on software that is installed on each laptop/telephone/PC/mac/tablet. The problem that this presents is that the company must keep the product updated for every version of laptop/telephone/PC/mac/tablet that we use. From experience of using the product we do not believe they are able to keep their product updated for multiple devices. We found significant issues with the software when using Citrix and the laptops in the Library (linux). We heard of further issues with ipads and we would expect more issues when manufacturers of tablets etc update their products.

 

Following this experience we took another look at Smoothwall: The physical machines that we use for Smoothwall are due to be replaced and they do not cope well with the potential 1100 devices that we have in school. We are hopeful/confident that replacing these servers and using the latest version of Smoothwall will alleviate these problems. We had previously budgeted to do this. We have also investigated simplifying the process of staff/students using Smoothwall. We are now confident that we can use a system called Web Cache Configuration Protocol (WCCP). WCCP means that staff/students will not need to enter any proxy settings into their devices because the content filtering will be transparent.

 

Although we are still concerned about the level of support we receive from smoothwall we have decided to continue using the system as we are confident that we can support it in-house. We have purchased a dedicated machine for this purpose and we intend on signing a three year contract in June 2014.

 

Authentication with the Lightspeed Rocket has been discussed in other threads...but incase anyone reads this I thought it best to clear up a couple of things.

 

The Agent in question above is not mandatory but optional, there are OSX, Windows, and Linux versions, and is generally recommended for managed wired devices and gives a very detailed view of client authentication events plus other useful information. A centralised DC agent can also be used, authentication on block messages, 802.1x for integration with wireless systems authentication such as Radius, and various captive portal options for BYOD or guest devices (unmanaged).

 

Also, incase it helps:

WCCP has been around a long time. Check out its abilities to filter HTTPS traffic before jumping.

 

If thinking of authenticating every session with a challenge like NTLM and you should check scalability...web 2 .0 creates lots of sessions.

 

Authentication is always a great topic of discussion but not that's straightforward when dealing with mixed environments and operating systems.

 

Look forward to more discussion

 

Simon

[CyberNerd]

Authentication with the Lightspeed Rocket has been discussed in other threads...but incase anyone reads this I thought it best to clear up a couple of things.

 

The Agent in question above is not mandatory but optional, there are OSX, Windows, and Linux versions, and is generally recommended for managed wired devices and gives a very detailed view of client authentication events plus other useful information.

 

The specific problems with the clients are that they are broken. Light speed engineers told us in no uncertain terms that the Linux client doesn't work and that the thin client option is broken for certain browsers. They don't seem to have an option for chrome books and I certainly would not recommend this solution for a BYOD school unless you are being very specific about the type of machines students bring in. I would be very worried that a simple browser or iOS update would knock a number of machines offline.

The non client transparent option is virtually unusable for example if you need to be able to log into an https site.

Light speed is a superb system if you've got a bunch of regular windows or Mac workstation and it has some really awesome features. Don't hold your breath if you want it to work with all devices. Hence our move to WCCP.

[Eappariello]

The specific problems with the clients are that they are broken. Light speed engineers told us in no uncertain terms that the Linux client doesn't work and that the thin client option is broken for certain browsers. They don't seem to have an option for chrome books and I certainly would not recommend this solution for a BYOD school unless you are being very specific about the type of machines students bring in. I would be very worried that a simple browser or iOS update would knock a number of machines offline.

The non client transparent option is virtually unusable for example if you need to be able to log into an https site.

Light speed is a superb system if you've got a bunch of regular windows or Mac workstation and it has some really awesome features. Don't hold your breath if you want it to work with all devices. Hence our move to WCCP.

@CyberNerd I can only apologise that you have received that information, it's not correct. If you pm me your school I can look into why this happened.

 

Browser updates have no bearing on our filtering ability, and the solution is browser agnostic. The last iOS7 update meant that safari checks in before loading with a cloud service, and this fix was available immediately upon release of iOS7

Lightspeed also fully supports Chromebooks, and we have several Chromebooks only customer sites.

 

Again, my apologies you received this incorrect information.

 

Happy to answer any other questions anyone has around this here or via PM

 

Simon