Patrick Posted July 18, 2019 Posted July 18, 2019 Fully agree. The best part about the lightspeed setup was a transparent proxy, and now that's gone.
Strawdog Posted July 18, 2019 Posted July 18, 2019 (edited) You can deploy/remove the setting through Apple Remote Desktop (ARD) if you have access to it and know some admin account credentials for their machine. We've got a small number of staff who still had internet access at home with the .pac file setting in place but the vast majority couldn't so we've removed it and turned off SSL decryption for now. Terminal Commands Set .pac file URL and enable Automatic Proxy Configuration (change 'Wi-Fi' to the network service name you wish to configure, e.g. 'Ethernet', etc.): - networksetup -setautoproxyurl Wi-Fi http://pac.education.btlancashire.co.uk/btls.pac Disable Automatic Proxy Configuration (the .pac file URL will remain but its use will be disabled): - networksetup -setautoproxystate Wi-Fi off Add certificate saved on desktop (change '***' to the username of the desktop in question) to Keychain and trust it: - security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /users/***/desktop/ca.crt Edited July 18, 2019 by Strawdog
Joanne Posted July 18, 2019 Author Posted July 18, 2019 That's great that the solution is accessible to all.... but you know what is better? Not having to do that! Think I'm just salty because of all the complaining I'm having directed at me.
Mark182 Posted July 18, 2019 Posted July 18, 2019 Anyone who has switched over use Azure AD connect set up on the DC for SSO? since the change over it works fine in school but no one can access office 365/e-mails out of school. Looking at the logs loads of stuff are getting blocked. Might have to read this and add loads of urls in. To be fair BTLS are working with us but it's not come at an ideal time (no time is ideal) that staff cannot access office 365 off site....
Mark182 Posted July 18, 2019 Posted July 18, 2019 Think we fixed it by also adding this to the shared list
browolf Posted July 18, 2019 Posted July 18, 2019 Not tested a Windows client but they don't use a .pac file so they should be fine. Another option is to turn off SSL decryption altogether (Policy Management -> Policy Manager -> select relevant policy -> URL/Keyword Shared Lists -> Manage Shared Lists -> Remove 'Selective Decryption and add 'No Decryption' lists) but given how many sites use HTTPS now this blows a major hole in your monitoring ability. The .pac file location (http://pac.education.btlancashire.co.uk/btls.pac) doesn't appear to be accessible from non-CLEO IPs. Apple Profile Manager has an option when defining a .pac file location to bypass it if it is unreachable but we don't manage most of our staff MacBooks with it (sods law we mainly use it to manage devices that remain in school) and I've not tested it yet. at the moment the pac file contains nothing of significance so it could temporarily be hosted elsewhere e.g. school webspace.
Strawdog Posted July 19, 2019 Posted July 19, 2019 Anyone else having fun with NHS nurses trying to connect to their VPN (PulseSecure - ras.northwestsis.nhs.uk/lcft)? It was working for them the other day but has stopped now, I did see an NHS IP (82.1.8.15) appear in the deny logs momentarily but I can't see a way to whitelist individual or ranges of IPs (beyond unblocking the whole 'Host is an IP' category)... Unblocking the category works but for obvious reasons I'd rather not do this.
browolf Posted July 23, 2019 Posted July 23, 2019 Here's how ours went: Most of the teachers were ok apart the ones who never reboot, so they didn't get the agent or certificate beforehand. Some random win 7 laptops refused to deploy the agent altogether. I trained work experience to sort 5-10 of those out manually. I didn't deploy the stuff on the admin network because on lightspeed they had no authorization filtered. But then on netsweeper it didn't work. In the end doing the group policy stuff worked best. Even though there's only about 4 people left on the admin network. The servers didn't work. Abtutor and pulseway both stopped working. It took me a while to figure out that I only needed set up a new thing and deploy the computer certificate and then they worked. The franking machine doesn't work because it can't install the certificate. BTLS have set us up something for that. I'm pleased to see they've moved C.....e from general support to something more technical. He's been tremendously helpful. I hope he got a payrise too.
ticktock Posted July 24, 2019 Posted July 24, 2019 Just be moved to Netsweeper and getting this message on some machines: "wagent launched with inactive gui session" and the wagent is an exclamation mark on a yellow background. Just wondered if anyone had seen this before.
Strawdog Posted July 25, 2019 Posted July 25, 2019 Not seen that error however the WAgent essentially just forwards the 'nsw-****' AD group membership for the current user - it's not the end of the world if it's not running or has gone wonky, the machine will instead be filtered based on it's IP. 1
ticktock Posted July 25, 2019 Posted July 25, 2019 I re-installed the agent which has fixed it. Got itself in a knot somehow.
Paul_L Posted July 26, 2019 Posted July 26, 2019 Here's how ours went: The franking machine doesn't work because it can't install the certificate. BTLS have set us up something for that. I just gave ours a static IP address and added it to the 'NSW-Unfiltered' group and it seems to work okay. Paul
Patrick Posted August 5, 2019 Posted August 5, 2019 Anyone having any issues with Unifi controllers not being able to download updates for AP's?
ticktock Posted August 5, 2019 Posted August 5, 2019 Issues with everything at the minute. Radius, captive portal, wrong message when a site is blocked. Can't download from Google play. Utter mess.
Patrick Posted August 5, 2019 Posted August 5, 2019 All my AP's are showing as update required but i can't download the updates in the controller. The button is just missing! I'm suspecting Netsweeper....
Patrick Posted August 5, 2019 Posted August 5, 2019 Ok it's Netsweeper. The AP's try to download the firmware but are failing becuase the URL for the FW is https. If i SSh into the AP's and manually update the firmware via CLI and remove the S from https firmware URL, it'll download and update.
browolf Posted September 5, 2019 Posted September 5, 2019 Since netsweeper, a bunch of win10 staff laptops no longer have internet access. Which stops outlook working. I found a microsoft url list that wasn't attached and I've tried disabling ncsi but neither of these have helped. It seems to be a problem on older versions of win10 - 2 that i've found an 1803 and a 2016 ltsb.
Strawdog Posted September 5, 2019 Posted September 5, 2019 Do they have the Netsweeper systray icon and is it identifying the user correctly (e.g. J.bloggs nsw-staff)? Are they having the .pac file applied correctly (LAN Settings)? you can try resetting the network connections on the affected clients: - netsh winsock reset netsh int ip reset Type ipconfig /release Type ipconfig /renew Type ipconfig /flushdns
browolf Posted September 5, 2019 Posted September 5, 2019 (edited) Do they have the Netsweeper systray icon and is it identifying the user correctly (e.g. J.bloggs nsw-staff)? Are they having the .pac file applied correctly (LAN Settings)? you can try resetting the network connections on the affected clients: - netsh winsock reset netsh int ip reset Type ipconfig /release Type ipconfig /renew Type ipconfig /flushdns It's one of those where nsci claims there's no internet access but it works fine otherwise. It's only outlook that's has a problem because it defers to ncsi and doesn't bother checking itself. I tried a reset from the troubleshooter, no good. I'll try the others Edit: the other things haven't worked either. Edited September 5, 2019 by browolf
Strawdog Posted September 6, 2019 Posted September 6, 2019 The issue might not be specifically related to NetSweeper - https://community.spiceworks.com/topic/2131702-limited-connectivity-indicated-but-internet-works
Smed Posted September 11, 2019 Posted September 11, 2019 Ok it's Netsweeper. The AP's try to download the firmware but are failing becuase the URL for the FW is https. If i SSh into the AP's and manually update the firmware via CLI and remove the S from https firmware URL, it'll download and update. i wondered why mine wouldnt update!!
Strawdog Posted September 16, 2019 Posted September 16, 2019 (edited) Anyone had any joy getting anything slightly approaching a useable report out of it? The search decryption seems to be working alright but the Prevent report is absolute crap (e.g. lancashiresafeguarding.org.uk and gatesnfences.com flagged as pornography, caraudiodirect.co.uk and enviroelectronics.co.uk flagged as weapons, msn.com flagged as extreme, etc.) :\ Edited September 16, 2019 by Strawdog
Joanne Posted September 16, 2019 Author Posted September 16, 2019 I've found the reports unusable. I thought that was one of the draws of changing filter too! Sure they are quick to run, but the output is utter garbage.
ticktock Posted September 16, 2019 Posted September 16, 2019 We found the other day that kids could access youtube by doing a google search in chrome. By clicking on the results it let you in even though BTLS were supposed to have blocked it. They said it was a known issue but hadn't bothered to tell anyone.
Joanne Posted September 18, 2019 Author Posted September 18, 2019 I e-mailed in regards to an app that was being blocked. I got absolutely nothing back from them, but the app works now, so I assume that they fixed it. Really wish they had sent me a quick ping to tell me though.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now