Smoothwall and eSafe

[Bruce123]

Is anyone using Smoothwall and eSafe together?

 

We've been trialling eSafe (from http://www.esafeglobal.com) for some time (in conjunction with our Smoothwall for filtering), but are encountering difficulties in getting them to work together.

 

At first we had a problem the root cert produced by an earlier version of Smoothwall (which didn't comply with the relevant standards), which caused it to fail eSafe SSL validation.

 

We upgraded to a newer version of SM (Leeds) and produced a new root cert, pushed it out and all seemed OK with eSafe. But then we started get the cert errors again (seemingly at random). By chance, I tried pushing out the Intermediate SM cert (the interception cert) to the intermediate store on the PCs, and this seemed to resolve the issue (not sure if the issue was with SM or eSafe).

 

However, having got around this, we are encountering an issue with certain sites, where if the user opens the site it fails to render properly in the browser and slows the PC down to the crawl while the tab remains open (in IE or Chrome). What we found is that the site (e.g. http://www.classcharts.com) typically makes use of a content delivery network for web objects (such as pictures, css etc.) and the browser isn't able to access those sites/objects. The sites are https and are intercepted by SM. Adding them to a group which disables SSL interception in SM seems to resolve the issue (and I suspect that asking eSafe to add them to their whitelist would also have worked). So basically we have found that the eSafe client doesn't always like https sites that have been intercepted by SM. We can add "problem" sites to SM's "no intercept" group, as and when they get reported.

 

However, a major problem with have is with our XenApp Citrix servers (think a group of terminal servers), which grind to a halt throughout the week with 100% CPU usage on all servers in the farm. I am unable to determine which process is responsible because I can't get onto the server to check.

 

As at any one time there might be 20 users connected to each server (each accessing a site) and we no way of determining if the issue is due to a (A) user(s) accessing a "problem" site or (B) if it is a resources issue (eSafe's decryption/inspection/encryption inherently uses quite a lot of CPU cycles). It matters because, the latter would require allocation of additional resources (we might get away with jigging the VMs around a bit or it may require additional hardware which has not been budgeted for).

 

We would like to use eSafe, and ELT really like the reports their getting through (from the desktops), but we don't seem to able to get passed this issue.

 

Are you currently using eSafe and SM together successfully?

 

I'm especially interested if anyone is using SM/eSafe with Terminal services/Citrix and what your experiences are of this?

 

Kind Regards,

 

Bruce.

Edited November 21, 2018 by Bruce123

[simpsonj]

We don't currently, but it's a setup that we're considering so interested if anyone else is using this setup.

[ataylor]

Ours is running relatively well at the moment in regards to smoothwall & Esafe together but we have had numerous issues in the past with versions of Smoothwall and esafe not being compatible. We also find esafe is quite demanding on the CPU while it is doing its https interception, the latest version improved performance but its still pretty poor. We have recently been looking into moving over to visigo after numerous issues with esafe, Visigo are pretty much just a keylogger but the reporting on incidents from the trial we had provided much more context regarding incidents and the report times were far superior.

 

Here is a recent post discussing Esafe

http://www.edugeek.net/forums/internet-related-filtering-firewall/199723-esafe-monitoring.html

[simpsonj]

Annoyingly, Visigo use device numbers for licences, where as E-Safe use student numbers. Ordinarily that would be fine, but for some reason one of my schools has more devices than students!

 

Still, I would be very interested in a comparison between E-Safe, Visigo and Securus 360.

[ataylor]

Our quote from Visigo was student based.