Has anyone heard of iBoss

[caffrey]

So BYOD ssl inspection is always going to be tricky without the SSL cert installed on personal devices (not exclusively laptops things like iPads / iPhones), which then becomes a bit of a grey area If I'm reading correctly.

[AMLinington]

So BYOD ssl inspection is always going to be tricky without the SSL cert installed on personal devices (not exclusively laptops things like iPads / iPhones), which then becomes a bit of a grey area If I'm reading correctly.

 

Basically, yes.

[trekmad]

We have had an onsite demo of iBOSS since Wednesday last week and it is so much better than Smoothwall. We are so happy with it we have decided to buy it straight away and not go back to our Smoothwall and hopefully we will be up and running on our own box next week. We had been a Smoothwall customer since 2008 and we are a day/boarding school in the UK.

Reasons are:

1. The responsiveness of the event logs and reporting is amazing compared to Smoothwall where you would run a report and go a watch a film in the time it would take to generate.

 

2. We were regularly getting emails from our ISP informing us that there were complaints from movie distribution companies that students were sharing movies from our network and the minute iBOSS was installed we had a load of disgruntled boarding students complaining that all of their VPN and proxy bypass programs were now blocked.

 

 

3. We were getting complaints from our boarders who were legitimately trying to use the internet for Skype to contact their families in other countries that they were unable to do so because the internet was too slow. This problem has ceased the minute iBOSS went in. We get daily internet bandwidth statistics from our ISP and previously we were peaking at 93MB of our 100MB leased line and now our highest peak is 71MB.

 

 

4. Finally the interface is so much easier to use and setting timers on website allow lists and website categories is much quicker and easier than it was on the Smoothwall.

If anyone has any specific question please feel free to PM me.

[Net-Ctrl]

If anyone else would like to organise an onsite demo to put the iboss solution through its paces or see some pricing, please PM me and I will get the balls rolling for you

 

Net-Ctrl are an official iboss partner with trained support engineers.

[trekmad]

Just finalised the costings with Rivanet (our supplier). Unit should be swapped out next week. Thanks @rpmoore for your assistance with this project.

[dastrix]

What have you swapped from trekmad and what are your reasons?

[dastrix]

I have to say this is making the decision easier and easier are you using the add on reporting device?

[trekmad]

We swapped from a virtual smoothwall which was our firewall and proxy. In the past we had a UTM but we decided to swap to a virtual appliance but the virtual disk kept corrupting leading to a reinstall. We had come to the conclusion that we needed layer 7 monitoring and blocking ability last year when we started receiving emails from our ISP regarding copyright infringement and whatever we did with smoothwall we seemed unable to stop the traffic without blocking legitimate applications through. We looked at a couple of other solutions but due to their high price we had to rule them out. For the price what iboss offer is fantastic and our issues were solved instantly. By blocking all of the VPN and proxy bypass traffic such as ultrasurf, TOR, hotspot shield etc our internet bandwidth has dropped considerably and we are no longer getting complaints that the internet is too slow.

 

We are using the smoothwall only as a firewall at the moment while we choose a suitable replacement but as we have until October when our renewal comes around there is no rush for this.

[dastrix]

This is exactly what I am finding and really good to here, I looked at layer 7 firewalls and found the price is an obstacle. Have you looked at pfsense?

[mjk]

Can't say I've ever had problems with vpn's and illegal downloads with smoothwall, which sounds like 99% of the problems experienced by @trekmad

How do students get around the smoothwall filters ? So I can learn to prevent it. Is it an inherent problem with smoothwall or a configuration issue?

[dastrix]

Its a config issue, however the firewall causes other issues where it blocks services that are required and it gets complicated

[caffrey]

Also VPN's tend to port hop, so you need to have layer 7, I didn't even know we had issues with VPN's until I was told

[mjk]

Also VPN's tend to port hop, so you need to have layer 7, I didn't even know we had issues with VPN's until I was told

 

So isn't the solution just ot FW everything except 80/443 which is forced through the proxy ? That's always what we have done and I can't see why this an iboss vs smoothwall problem.

I was interested in iboss because of the wire speed filtering, but if it doesn't happen on https I see very little benefit so far.

[Net-Ctrl]

@mjk, as smoothwall is a proxy based filter, it does not see lots of port agile traffic that mainly hides in high UDP port ranges. Their response to blocking things like Ultrasurf and TOR is to block pretty much all outgoing TCP/UDP ports on their firewall. However, such apps also happily resort to port 80, 443 etc in such circumstances, and without proper Layer-7 control there is nothing Smoothwall can do about these.

 

@dastrix, a true gigabit throughput L7 firewall device is expensive. Iboss is pretty unique in putting L7 controls into the web filter meaning that you could get away with a cheaper firewall from many of the main vendors, or pfsense if you prefer.

 

In terms of the add on reporter, this is only required where you have a really large network (over 3000 devices) and want to run the Firesphere APT threat solution on the SWG box, or if you have multiple SWG gateway boxes that need to report into a single destination. For most schools the integrated SWG with onboard reporter will be fine. We can help and advise on the specification required for each customer.

[mjk]

@mjk, as smoothwall is a proxy based filter, it does not see lots of port agile traffic that mainly hides in high UDP port ranges. Their response to blocking things like Ultrasurf and TOR is to block pretty much all outgoing TCP/UDP ports on their firewall. However, such apps also happily resort to port 80, 443 etc in such circumstances, and without proper Layer-7 control there is nothing Smoothwall can do about these.

 

I'm sorry I'm not really following. Currently we block pretty much everything tcp/udp to everywhere. Certain services (IMAP for example) are allowed out, but only to specific ip addresses. Everything else needs to go through 80/443 on proxy. Given that https interception occurs here I am not seeing what the benefit is.

[Net-Ctrl]

@mjk Looks like you have adopted best practice in restricting outbound traffic, however applications like Ultrasurf, Skype, TOR (plus Backdoors, botnet C&C and APT’s) can still use 80 and 443 – even with valid SSL sessions as they are not only port evasive but protocol evasive. These applications can send valid HTTP and create valid TLS sessions thus disguise or hide their communications within port 80 and 443. This is why you still need full layer 7 deep packet analysis.

 

Unless you use a domain and IP allow on the proxy and block everything else these types of apps will still pass – and they will seriously effect the online learning experience.

[mjk]

Thanks.

I've set the Friday afternoon challenge to the techs:

Using any BYOD device, with only a yr9 account. I want any Mad Max screener by the end of the day!

[dastrix]

Lol sounds like a challenge

[AMLinington]

Can't say I've ever had problems with vpn's and illegal downloads with smoothwall, which sounds like 99% of the problems experienced by @trekmad

How do students get around the smoothwall filters ? So I can learn to prevent it. Is it an inherent problem with smoothwall or a configuration issue?

 

Any product is only as good as its configuration and maintenance. Over time requirements change and people have a habit of requesting exceptions to be added until your endpoint protection is so full of holes it may as well not be there. Doesn't mean one product is 'worse' than another, just that the configuration of whichever product you're using needs to be overhauled regularly to make sure it is still meeting the needs of the business.

@trekmad - sounds like some key firewall and port rules were missing - a simple fix tbh. @mjk see above. Proxy bypass programs exist to get around firewall blocks by exploiting any holes you've opened up. A product will only ever be as good or effective as its administrators are at keeping on top of exception requests. This is purely a configuration and user maintenance issue. If the business doesn't have an interest in protecting their network security by overriding your objections to opening up gigantic holes in the firewall then you shouldn't worry about it. That's on them.

[AMLinington]

@mjk, as smoothwall is a proxy based filter, it does not see lots of port agile traffic that mainly hides in high UDP port ranges. Their response to blocking things like Ultrasurf and TOR is to block pretty much all outgoing TCP/UDP ports on their firewall. However, such apps also happily resort to port 80, 443 etc in such circumstances, and without proper Layer-7 control there is nothing Smoothwall can do about these.

 

@dastrix, a true gigabit throughput L7 firewall device is expensive. Iboss is pretty unique in putting L7 controls into the web filter meaning that you could get away with a cheaper firewall from many of the main vendors, or pfsense if you prefer.

 

In terms of the add on reporter, this is only required where you have a really large network (over 3000 devices) and want to run the Firesphere APT threat solution on the SWG box, or if you have multiple SWG gateway boxes that need to report into a single destination. For most schools the integrated SWG with onboard reporter will be fine. We can help and advise on the specification required for each customer.

 

Have you reviewed the Layer-7 application blocking protocols that were released in the Smoothwall a year or so ago?

[mjk]

Thanks.

I've set the Friday afternoon challenge to the techs:

Using any BYOD device, with only a yr9 account. I want any Mad Max screener by the end of the day!

 

It's looking increasingly likely I'm off to the cinema tonight. At least i have a bit more confidence in the system. Thanks guys.

[caffrey]

Have you reviewed the Layer-7 application blocking protocols that were released in the Smoothwall a year or so ago?

 

It was an module that you had to pay for, I tried it and it wasn't very effective, that or I didn't know what I was doing and there wasn't any real documentation

 

 

@mjk seeing as it's BYOD - install a VPN at home then try it in school or is this what you did ?

[AMLinington]

It's looking increasingly likely I'm off to the cinema tonight. At least i have a bit more confidence in the system. Thanks guys.

 

It might be deeply masochistic of me but I really want to see that new Jurassic World movie. I'm going to assume it is basically Pacific Rim with Dinosaurs. If I go in with no expectations of any science making sense, and try not to take it seriously and just enjoy the screaming, running and general toothy and bloody destruction then it's going to be ACE.