BTLS Moving to Netsweeper from Lightspeed

[Strawdog]

We're still having fun with various staff unable to access the pac file (http://pac.education.btlancashire.co.uk/btls.pac) from home, on their school issued laptops, thereby having no internet access - we've taken to switching Firefox/Chrome to no proxy and telling them to stick to those browsers at home. I raised it with one of the main BTLS engineers (unfortunately not in a ticket) back in July but it's still broken :\

 

Odd thing is this doesn't affect all staff so I'm presuming BTLS just aren't allowing some ISP ranges to reach it.

 

Currently trying to raise a ticket with them about it but I'm just getting told that it's working as intended, that the staff member needs to edit their network connections if they want to use their laptops at home, it's up to the headmaster's discretion, BTLS can't support home connections, etc.

[ticktock]

Students have been getting into lots of inappropriate sites at our school. Everything from games to weapons and forums. I'm having to block stuff as I go along despite assurances that this had all been "sorted". All stuff that was blocked by default on lightspeed. I wouldn't hold your breath for any kind of fix as they just ignore it and hope you will go away. Keep pushing for a solution and put a complaint in. The whole thing is an untested mess that has caused me grief for weeks.

[SimpleSi]

We're still having fun with various staff unable to access the pac file (http://pac.education.btlancashire.co.uk/btls.pac) from home, on their school issued laptops, thereby having no internet access

 

I thought the way the system is supposed to work is that that address ISN'T reachable from home, so after a timeout interval, the laptop will set itself to no proxy.

 

e.g there is a delay when first launching browser but then afterwards it will work fine.

[Joanne]

What kind of laptops are they?

 

We are running Windows 10 domain connected laptops and nobody has told me they can't work from home. The pac file shouldn't be in the proxy settings anyway should it?

[Strawdog]

I thought the way the system is supposed to work is that that address ISN'T reachable from home, so after a timeout interval, the laptop will set itself to no proxy.

 

Apparently there's two different .pac files being served to clients depending on whether they're originating from an internal CLEO IP or an external IP - not sure how this is possible from a single URL (some funky intranet routing/resolution?)... One has the relevant entries to work in school and the other has the entries to work at home :\

 

What kind of laptops are they?

 

We are running Windows 10 domain connected laptops and nobody has told me they can't work from home. The pac file shouldn't be in the proxy settings anyway should it?

 

Windows 10 but we've also had the same issue with MacBooks and iPads.

 

The .pac file address goes in the Auto Proxy field (the contents of the .pac file then instructs the machine what proxy to use/how to use it).

 

Turns out you don't need to use the .pac file at all, I was under the impression it was needed to enable SSL decryption in NetSweeper but I've now been told that's not the case.

 

For those struggling with the quality of the reports there are some new V2 reports in the Create Reports section, I've only had a quick look but they do appear to be better than the ones NetSweeper shipped out with.

Edited September 20, 2019 by Strawdog

[browolf]

Students have been getting into lots of inappropriate sites at our school. Everything from games to weapons and forums. I'm having to block stuff as I go along despite assurances that this had all been "sorted". All stuff that was blocked by default on lightspeed. I wouldn't hold your breath for any kind of fix as they just ignore it and hope you will go away. Keep pushing for a solution and put a complaint in. The whole thing is an untested mess that has caused me grief for weeks.

 

I'm having an opposite problem. Staff are going mad because loads of things are blocked that weren't before and random youtube videos get a weird error, ruining their lesson plans.

[Strawdog]

I added all the following to a custom Allow list, I already had the BTLS 'YouTube - Allow' list applied but we were still having problems with YouTube not loading some content: -

 

youtube.com

youtu.be

youtube-nocookie.com

ytimg.com

youtube.co.uk

googlevideo.com

 

I'm just in the process of collating a list of sites blocked by the 'Ad Blocking' category as we're experiencing really slow load times on websites (e.g. booking.com, thetrainline.com, premierinn.com, virgintrains.co.uk) that load in content from various blocked external ad and metric networks (e.g. doubleclick.net, yieldoptimizer.com, googlesyndication.com, appdynamics.com). I don't want to allow them as I hate adverts as much as the next human and there's been plenty of ad companies serving infected banners in the past but I'm having my head pecked by staff about it.

Edited September 20, 2019 by Strawdog

[Joanne]

For those struggling with the quality of the reports there are some new V2 reports in the Create Reports section, I've only had a quick look but they do appear to be better than the ones NetSweeper shipped out with.

 

mmmm.....

 

 

Literally no other information, just the number of triggers!

[Strawdog]

If you click on View PDF or export the report you will get the client detail.

 

edit - lol was wondering why the screenshot I was trying to embed wasn't appearing, it's because NetSweeper has blocked it as 'Weapons'....

[Joanne]

hahahahah! Oooohh I love it. So much fun this filter.

[cheekycharly]

Having a fight with it at all schools that I visit. Considering selling them a broadband package and using the CLEO filtering like they used to and bombing off the BT Lancashire setup upon renewal. Im onsite at a school where the MESH wifi system is being blocked and cannot check in with the server making the Wifi down across the school all it can do is local traffic.

 

Added all the given "Cloud Trax" firewall URL's and IP's but same problem.

 

Head > Boil > Pan!

 

TGIF

 

P.S. I'm about to read through this whole thread to see if I can pluck any answers out from it.

 

EDIT: Nearly a full hours read! Now i'm ready for a beer.

Edited September 20, 2019 by cheekycharly

[Strawdog]

Just done some more testing at home using the .pac file on my work MacBook - the file is definitely not reachable via Sky; On timing out a client machine should default to using no proxy (DIRECT - this is the only entry currently within the .pac file anyway), as SimpleSi said, however it appears there's been a long standing issue in OS:X/MacOS (and I believe iOS too) where this doesn't happen and instead the device just refuses to load anything (this isn't limited to Safari as I'm also seeing this behaviour in Firefox).

 

I've tested using the .pac file on my personal Win10 laptop and it's working fine in both IE and Firefox (after timing out trying to reach the .pac file, on the initial page request, browsing is fine).

 

I've not seen the slow browsing/hanging at home issue first hand on a Windows machine but I've had 2 different members of staff report it to me (both Win10 users) and in both cases I switched their Firefox and Chrome to No Proxy and they both reported back that fixed it.... Think I'm going to have to grab one of their machines for a bit of home testing.

 

Given the current .pac file doesn't have anything in it anyway I'm going to nuke the entry across the board but I'm curious as to why we're seeing it cause problems just because it's unreachable and whether this is affecting OS:X/MacOS, iOS and Win10 clients.

 

The easy solution would be for BTLS to host it somewhere publicly accessible but this isn't practical in all environments and browsing should still work even if access is restricted.

Edited September 20, 2019 by Strawdog

[browolf]

is netsweeper enforcing youtube restricted mode?

 

On a youtube.com/user/CooCurrent/playlists there are 6 playlists of "the body story" but on our staff filtering only 1 shows up.

[Strawdog]

Yep looks like restricted mode is nobbling them as they'll be flagged as mature content (e.g. -

)

 

We're having fun this morning with certificate errors blocking YouTube access for multiple users (the BTLS certificate is installed and trusted).... Browsing to http://www.youtube.co.uk seems to get around it (the blocked screenshot is from trying to access youtube.com, the allowed screenshot is going to youtube.co.uk first and it then redirecting to youtube.com)

 

Edited September 24, 2019 by Strawdog

[Joanne]

Yep looks like restricted mode is nobbling them as they'll be flagged as mature content (e.g. -

)

 

We're having fun this morning with certificate errors blocking YouTube access for multiple users.... Browsing to http://www.youtube.co.uk seems to get around it (the blocked screenshot is from trying to access youtube.com, the allowed screenshot is going to youtube.co.uk first and it then redirecting to youtube.com)

 

[ATTACH=CONFIG]55082[/ATTACH]

[ATTACH=CONFIG]55083[/ATTACH]

 

Sweet, sweet irony.... (after clicking on your screenshot)

 

[Strawdog]

Yep that's what I was banging my head against on an earlier post, I don't get why I can happily browse numerous pages under edugeek.net but if it has /attachments on the end NetSweeper suddenly decides it's weapons... I've added 'edugeek.net' to our allow list and I can see all the embedded screenshots now.

[Aedra]

Just be moved to Netsweeper and getting this message on some machines:

 

"wagent launched with inactive gui session" and the wagent is an exclamation mark on a yellow background.

 

Just wondered if anyone had seen this before.

 

Yes, this message will probably because you are RDP'ed onto the device. For example if you installed the WAgent onto a VM which you remote onto, Netsweeper will be unable to read the session and will default back to its IP based filtering. It will not apply the AgentDeny as it would if the Group was not found.

 

Charlie.

[Aedra]

Ok it's Netsweeper. The AP's try to download the firmware but are failing becuase the URL for the FW is https. If i SSh into the AP's and manually update the firmware via CLI and remove the S from https firmware URL, it'll download and update.

 

Hi Patrick,

 

As you mentioned, this will be due to the HTTPS request requiring decryption by the Netsweeper Filter. There has been a number of URLs added to the 'Selective Decryption' Shared List to resolve this, the list itself is in place to force decryption of websites bar the ones listed. There are currently a number of URLs listed to resolve issues with devices unable to install the Certificate, but it is possible some may have been missed as this is a WIP Shared List and will likely be updated over time. Currently within the list the two I can see which relate to this are:

dl.ubnt.com

config.ubnt.com

 

If you wish to review the list for yourself 'URL Tools > URL List Manager > Selective Decryption'

 

Apologies if you have had to individually connect to each device and change this, however if you would still like to review advising the URL you were having issues with and the rough date/time I can review further and add to this to the list which is applied to all schools.

 

Regards,

Charlie.

[Aedra]

is netsweeper enforcing youtube restricted mode?

 

On a youtube.com/user/CooCurrent/playlists there are 6 playlists of "the body story" but on our staff filtering only 1 shows up.

 

Hi,

 

No, Netsweeper should currently be enforcing Moderate Safe Search. DUring the initial implimentation of Netsweeper we had this set to Strict to ensure only safe videos were visible, however we found that the Strict/Moderate settings within YouTube are not as accurate as we had hoped so we had to reduce this.

 

This is set at a System level currently, which means unfortunately this is not possible to override using either the Categories, Shared Lists or Local Lists.

 

The videos which are not allowed to be viewed under Moderate, when viewed directly through YouTube, will not display. However if you have a direct URL to the video which you cant find, you will most likely see a black video with some writing saying something similar to 'You must be logged in with a Google Account to view this content'. This can then only be accessed with an appropriotely aged account at this time.

 

Regards,

Charlie.

[Aedra]

Sweet, sweet irony.... (after clicking on your screenshot)

 

[ATTACH=CONFIG]55084[/ATTACH]

 

Hi Joanne,

 

I have reviewed the screenshot and the title of the screenshot contains 'screen shot' as two separate words. Unfortunately this has been picked up by the 'Search Keywords' Shared List and the word 'Shot' has flagged this as Weapons. Locally allowing the EduGeek website as per Strawdog will resolve that issue, or alternatively you can remove the 'Search Keywords' from the 'nsw-*' Group you are in as this may not be necessary for Staff.

 

Regards,

Charlie.

[Joanne]

Thanks for that Charlie. When I try to remove the nsw-unfiltered group from this area, it doesn't do anything. I select the group, click on the bin and nothing happens. Am I in the right place?

 

[caffrey]

I turned that off under Policy manager, (pick your policy) categories and you can find it under system, advanced,search keywords - I've no idea what's under that list though

[Strawdog]

Hi,

 

No, Netsweeper should currently be enforcing Moderate Safe Search. DUring the initial implimentation of Netsweeper we had this set to Strict to ensure only safe videos were visible, however we found that the Strict/Moderate settings within YouTube are not as accurate as we had hoped so we had to reduce this.

 

This is set at a System level currently, which means unfortunately this is not possible to override using either the Categories, Shared Lists or Local Lists.

 

The videos which are not allowed to be viewed under Moderate, when viewed directly through YouTube, will not display. However if you have a direct URL to the video which you cant find, you will most likely see a black video with some writing saying something similar to 'You must be logged in with a Google Account to view this content'. This can then only be accessed with an appropriotely aged account at this time.

 

Regards,

Charlie.

 

Hi Charlie,

 

If anything the filtering of YouTube content now appears to be more restrictive than it was...

 

Couple of examples: - Our RS department wants to show this -

but it's currently blocked, it's a 1979 film about the life of Jesus that is rated G (https://www.imdb.com/title/tt0079368). Being logged in with an age verified YouTube account makes no difference, the video remains inaccessible.

 

This is is a 4 minute clip from the film Pearl Harbour (PG-13) that our English department want to use, this is also blocked -

[Aedra]

Thanks for that Charlie. When I try to remove the nsw-unfiltered group from this area, it doesn't do anything. I select the group, click on the bin and nothing happens. Am I in the right place?

 

[ATTACH=CONFIG]55099[/ATTACH]

 

Hi Joanne,

 

This is not a way which I have tried before. I believe that this may not function correctly as you are trying to edit the Shared List itself which you will not have permissions for.

 

However you can amend this by removing it from the Group directly, 'Policy Manager > nsw-unfiltered > URL/Keyword Shared List > Manage Shared Lists', the left hand column is the one which includes all the Shared Lists currently applied and the right are the Shared Lists available to be applied. Clicking on the name will flick the Shared List to the other side.

 

Regards,

Charlie.

[Joanne]

I turned that off under Policy manager, (pick your policy) categories and you can find it under system, advanced,search keywords - I've no idea what's under that list though

 

Took some finding, but I got it. Thank you!!

 

I really do feel like I muddle through this filter. I'm not even sure I'm correctly blocking websites....