Filtering/VPN/Security setup on non LEA ISP / UTM recomendation

[chrisakak9]

Hi all,

 

Wondering what people are using away from the LEA ISP.

 

We moved away from Leeds Learning and switched to EXA. Initially their filtering was great but as of late many websites seem to be uncategorised and allows access so i have to block these with Sophos.

Currently we use only the router basic firewall and setup a spare server as a VPN server for file access at home (staff laptops only)

 

Leading me to look at something better (at low cost if possible). From what I can see it would be better to stick a UTM in and have that take up the slack but I'm not quite sure what would fit the bill.

 

We still operate as a 2 domain school with curriculum and admin on 2 subnets, each has its own gateway on the router (Vigor 2830) currently filtered by exa per subnet. and an additional guest gateway on a separate WiFi VLAN

 

We would like

Decent content filtering per subnet and linked to AD groups (essentially only the curriculum needs AD)

Secure VPN (only needed for curriculum)

decent firewall, which allows admin to see curriculum but blocks curriculum seeing admin and sandboxes guest Wireless. I'd also like to be able to add another subnet for third party systems i.e. PBX that can't see the other nets but that can see it.

 

hope this makes sense.

Edited April 23, 2015 by chrisakak9

[mikkydoos]

Smoothwall here. I've seen Bloxx and that looks ok

[sparkeh]

Smoothwall UTM here. Would highly recommend it.

[chrisakak9]

do you guys have multiple LANs, multiple domains and subnets on the UTM? or would you need a UTM per LAN

[exa_markd]

@chrisakak9, at Exa we endeavour to fulfil our customer's needs with this in mind I would like to understand more about the challenges you are facing in relation to content filtering. We have a category that can block what we deem "Uncategorised websites or websites where it is less obvious what the exact category should be." We also provide the means to let Exa know when things need global classification change if we have it wrong and customers all gain the corrected category. It is also possible to reclassify websites at the customer level to override the global classification if necessary. It sounds like you are using our entry level SurfProtect Cloud product - maybe with SurfProtect Proxy to protect HTTPS traffic? Which is also included at no extra charge to your connection

 

 

If you require AD integration, Single Sign-on, full HTTPS filtering then you would be best using our SurfProtect Fusion product which requires a ICAP/UTM device that we can provide, configure and maintain for you. You would not need the 2 LAN approach with the ICAP UTM if you wanted to merge the LANs. Filtering would also be based on AD users, user groups or internal IP.

 

 

I work on the SurfProtect Product Team as an Engineer, please can you PM me and we can help resolve your challenges with the filtering.

[SchoolsBroadband]

Hi Chris,

 

look no further than Lightspeed or Smoothwall. Both will do what you want and are great products.

 

We offer Lightspeed & Fortinet as standard with no need for additional onsite hardware with all of our School Internet products. Many schools / users on Edugeek already use us and its easy to move ISP so just ask about if you need any reference sites or let me know and I'll send you some.

 

If not good luck getting to work what you need.

 

Thanks

 

Dave

 

Hi all,

 

Wondering what people are using away from the LEA ISP.

 

We moved away from Leeds Learning and switched to EXA. Initially their filtering was great but as of late many websites seem to be uncategorised and allows access so i have to block these with Sophos.

Currently we use only the router basic firewall and setup a spare server as a VPN server for file access at home (staff laptops only)

 

Leading me to look at something better (at low cost if possible). From what I can see it would be better to stick a UTM in and have that take up the slack but I'm not quite sure what would fit the bill.

 

We still operate as a 2 domain school with curriculum and admin on 2 subnets, each has its own gateway on the router (Vigor 2830) currently filtered by exa per subnet. and an additional guest gateway on a separate WiFi VLAN

 

We would like

Decent content filtering per subnet and linked to AD groups (essentially only the curriculum needs AD)

Secure VPN (only needed for curriculum)

decent firewall, which allows admin to see curriculum but blocks curriculum seeing admin and sandboxes guest Wireless. I'd also like to be able to add another subnet for third party systems i.e. PBX that can't see the other nets but that can see it.

 

hope this makes sense.

[chrisakak9]

for example i am trying to block on-line chat sites but as SurfProtect sees them as unclassified it allows them though and even though i have added various sites to the block list, they are not being blocked.

Other examples include being able to search things like c u n t, bum plug, nip slip, rabbit vibe and the abillity to play graphic videos such as this * Graphic Video link removed by moderators *

 

Even though when I lookup these sites other classification systems, they do list the relevant categories and should be blocked.

Following recent updates to SurfProtect, I also ended up with an unfiltered line.

 

I'm not essentially looking to replace anything more looking to add to our network with multiple levels of protection and advancement of what we currently have.

 

I did previously see a demo of smoothwall and it brings features that are not availiable via surfprotect, ie removing youtube comments.

Edited April 28, 2015 by elsiegee40
Link to graphic video material removed

[mikkydoos]

Have a chat to Smoothwall m8, u won't go wrong

[exa_markd]

Chris I think you need to talk to us at Exa directly if you have issues or possibly don't understand how our product works.

 

Please call us free on 0808 123 2323 and we can discuss your issues.

Kind Regards

Mark Dearlove

SurfProtect Team

[EXA_Mark]

Hi Chris,

 

As per Mark D's post can you please give us a call as the problems you experience can be easily resolved, as they are standard features of the product. And unlike others that are out there, such as Lightspeed we are already well ahead of the game on things such as Google HTTPs. Many of the features you are wanting have been in place for a few years. There is definitely no need for you to consider spending additional money on an expensive firewall and filtering service such as Smoothwall when everything you have mentioned is already in place with SurfProtect and is inclusive at no charge (unlike things such as Lightspeed) with your Exa connection.

 

I am concerned also over the comment that following recent updates you ending up with no filtering. Whilst we do constantly update SP, and have done for 10 + years, If we had run an update on SP that removed filtering altogether we would have thousands of schools calling us.

 

Of course, if you do want to use a third party service, such as Smoothwall, with our connectivity you can use whatever you want, we don't restrict you from doing that, we just don't want to see a customer spending money they may not need to.

[mattprice]

Hello

 

Please allow me to clarify our support for HTTPS inspection. We have had full support for this for several years now.

 

HTTPS inspection will allow you to see Google search queries both now and after the upcoming changes to Google's services, which will force all Google traffic to become encrypted after around June 2015. Additionally, it gives us the ability to inspect and filter HTTPS traffic to all sites. It allows us to view not just the full URL that someone is accessing, but also all of the links and images within that page too.

 

The only way to view any kind of encrypted web traffic is by acting as a 'man in the middle' trusted proxy. I fully appreciate that this can be time consuming for schools to set up initially, but this is actually a very good thing; if this was not the case, then no-one would be able to trust secure services such as online banking. Due to the design of HTTPS traffic, having a system that can act as a trusted proxy really is the only way this traffic can be decrypted. Again, we have been able to do this for several years.

 

We have made this as easy as possible for schools to implement, using methods such as Proxy Auto Configuration (PAC) files and through WCCP, which can be thought of as an automatic proxy, as clients joining the network do not have to enter any proxy settings. This has proven particularly useful for BYOD scenarios, where asking visitors to manually enter proxy settings can be unfeasible.

 

To summarise - Lightspeed Systems Web Filter can fully analyse, inspect and block HTTPS traffic, and this is not a new feature for us.

 

 

Please feel free to DM me with any questions.

 

 

Matt Price

Engineer - Lightspeed Systems

[chrisakak9]

Hi Mark,

 

The issue regarding the non filtering was reported on 24/04/15 and was dealt with by David on the SurfProtect team.

After experiencing various filtering issues, I isolated my laptop from our Sophos Web Control policy to take it to SurfProtect only, this resulted in no filtering allowing me access to any site including pornographic and the bannedsite.surfprotect.co.uk test page.

Our Profile has now been configured as to function using the old surfprotect panel for management.

 

 

Additionally as a note to other users:

I am not here to rate the service of any company be that of Exa or any other.

I am simply here to enquire what other schools use and look at methods of multiple lines of safeguarding children from the dark side of the net. I hope everyone would agree that this is a top priority

 

 

I am concerned also over the comment that following recent updates you ending up with no filtering. Whilst we do constantly update SP, and have done for 10 + years, If we had run an update on SP that removed filtering altogether we would have thousands of schools calling us.

 

* Graphic Video link removed by moderators *

This was a video on the website LiveLeak showing the decapitation of a man!

Edited May 1, 2015 by chrisakak9

[EXA_Mark]

Thank you Chris,

 

As you can imagine, given this is my company, I am always keen to ensure we are doing our best and that the service is working as it should. Also because the product is constantly being updated (as I am sure other filtering services are), we want to make sure that our customers are aware of all the options open to them to get the very best filtering, and safeguarding the children.

 

Safeguarding children, has always been at the heart of what we have done, what we do now, and what we will do in the future. It is the key reason SurfProtect even exists to start with. Rather than just reselling other companies services, such as those mentioned before (Lightspeed/Smoothwall), we developed our own system, which we have complete control and future development over, and our customers are not waiting on a third party releasing updates when/if they notify us of problems or challenges they are facing. Because all our development is done in house, nothing is outsourced at all, this means we can and do run very frequent development updates (in an Agile methodology) to ensure our customers can have their filtering exactly how they want it.

 

My concerns over the comments previously were of a nature that some of the things you were wanting to achieve are standard features of SurfProtect or SurfProtect Fusion, and that you could do them now, without potentially having to spend any more money and still making sure you had the right safeguards in place for your children.

 

I hope you have now managed to speak to MarkD (who posted previously) to ensure you have the filtering how you want it, and you are welcome to come across to our Bingley offices (not that far from Leeds) to speak to the development team in person if you like, and we can give you some in person training on both SurfProtect and SurfProtect Fusion. To be clear this offer is open to any of our schools, and always has been. It's always nice to see a new face or two at the office.