BTLS Moving to Netsweeper from Lightspeed

[Patrick]

Fully agree. The best part about the lightspeed setup was a transparent proxy, and now that's gone.

[Strawdog]

You can deploy/remove the setting through Apple Remote Desktop (ARD) if you have access to it and know some admin account credentials for their machine.

 

We've got a small number of staff who still had internet access at home with the .pac file setting in place but the vast majority couldn't so we've removed it and turned off SSL decryption for now.

 

Terminal Commands

Set .pac file URL and enable Automatic Proxy Configuration (change 'Wi-Fi' to the network service name you wish to configure, e.g. 'Ethernet', etc.): -

networksetup -setautoproxyurl Wi-Fi http://pac.education.btlancashire.co.uk/btls.pac

 

Disable Automatic Proxy Configuration (the .pac file URL will remain but its use will be disabled): -

networksetup -setautoproxystate Wi-Fi off

 

Add certificate saved on desktop (change '***' to the username of the desktop in question) to Keychain and trust it: -

security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /users/***/desktop/ca.crt

Edited July 18, 2019 by Strawdog

[Joanne]

That's great that the solution is accessible to all.... but you know what is better? Not having to do that!

 

Think I'm just salty because of all the complaining I'm having directed at me.

[Mark182]

Anyone who has switched over use Azure AD connect set up on the DC for SSO? since the change over it works fine in school but no one can access office 365/e-mails out of school. Looking at the logs loads of stuff are getting blocked. Might have to read this and add loads of urls in. To be fair BTLS are working with us but it's not come at an ideal time (no time is ideal) that staff cannot access office 365 off site....

[Mark182]

Think we fixed it by also adding this to the shared list

[browolf]

Not tested a Windows client but they don't use a .pac file so they should be fine.

 

Another option is to turn off SSL decryption altogether (Policy Management -> Policy Manager -> select relevant policy -> URL/Keyword Shared Lists -> Manage Shared Lists -> Remove 'Selective Decryption and add 'No Decryption' lists) but given how many sites use HTTPS now this blows a major hole in your monitoring ability.

 

The .pac file location (http://pac.education.btlancashire.co.uk/btls.pac) doesn't appear to be accessible from non-CLEO IPs.

 

Apple Profile Manager has an option when defining a .pac file location to bypass it if it is unreachable but we don't manage most of our staff MacBooks with it (sods law we mainly use it to manage devices that remain in school) and I've not tested it yet.

 

at the moment the pac file contains nothing of significance so it could temporarily be hosted elsewhere e.g. school webspace.

[Strawdog]

Anyone else having fun with NHS nurses trying to connect to their VPN (PulseSecure - ras.northwestsis.nhs.uk/lcft)? It was working for them the other day but has stopped now, I did see an NHS IP (82.1.8.15) appear in the deny logs momentarily but I can't see a way to whitelist individual or ranges of IPs (beyond unblocking the whole 'Host is an IP' category)...

 

Unblocking the category works but for obvious reasons I'd rather not do this.

[browolf]

Here's how ours went:

 

Most of the teachers were ok apart the ones who never reboot, so they didn't get the agent or certificate beforehand.

Some random win 7 laptops refused to deploy the agent altogether. I trained work experience to sort 5-10 of those out manually.

 

I didn't deploy the stuff on the admin network because on lightspeed they had no authorization filtered. But then on netsweeper it didn't work.

In the end doing the group policy stuff worked best. Even though there's only about 4 people left on the admin network.

 

The servers didn't work. Abtutor and pulseway both stopped working. It took me a while to figure out that I only needed set up a new thing and deploy the computer certificate and then they worked.

 

The franking machine doesn't work because it can't install the certificate. BTLS have set us up something for that.

 

I'm pleased to see they've moved C.....e from general support to something more technical. He's been tremendously helpful. I hope he got a payrise too.

[ticktock]

Just be moved to Netsweeper and getting this message on some machines:

 

"wagent launched with inactive gui session" and the wagent is an exclamation mark on a yellow background.

 

Just wondered if anyone had seen this before.

[Strawdog]

Not seen that error however the WAgent essentially just forwards the 'nsw-****' AD group membership for the current user - it's not the end of the world if it's not running or has gone wonky, the machine will instead be filtered based on it's IP.

[ticktock]

I re-installed the agent which has fixed it. Got itself in a knot somehow.

[Paul_L]

Here's how ours went:

 

 

The franking machine doesn't work because it can't install the certificate. BTLS have set us up something for that.

 

I just gave ours a static IP address and added it to the 'NSW-Unfiltered' group and it seems to work okay.

 

 

Paul

[Patrick]

Anyone having any issues with Unifi controllers not being able to download updates for AP's?

[ticktock]

Issues with everything at the minute. Radius, captive portal, wrong message when a site is blocked. Can't download from Google play. Utter mess.

[Patrick]

All my AP's are showing as update required but i can't download the updates in the controller. The button is just missing! I'm suspecting Netsweeper....

[Patrick]

Ok it's Netsweeper. The AP's try to download the firmware but are failing becuase the URL for the FW is https. If i SSh into the AP's and manually update the firmware via CLI and remove the S from https firmware URL, it'll download and update.

[browolf]

Since netsweeper, a bunch of win10 staff laptops no longer have internet access. Which stops outlook working. I found a microsoft url list that wasn't attached and I've tried disabling ncsi but neither of these have helped. It seems to be a problem on older versions of win10 - 2 that i've found an 1803 and a 2016 ltsb.

[Strawdog]

Do they have the Netsweeper systray icon and is it identifying the user correctly (e.g. J.bloggs nsw-staff)?

Are they having the .pac file applied correctly (LAN Settings)?

 

you can try resetting the network connections on the affected clients: -

 

netsh winsock reset

netsh int ip reset

Type ipconfig /release

Type ipconfig /renew

Type ipconfig /flushdns

[browolf]

Do they have the Netsweeper systray icon and is it identifying the user correctly (e.g. J.bloggs nsw-staff)?

Are they having the .pac file applied correctly (LAN Settings)?

 

you can try resetting the network connections on the affected clients: -

 

netsh winsock reset

netsh int ip reset

Type ipconfig /release

Type ipconfig /renew

Type ipconfig /flushdns

 

 

It's one of those where nsci claims there's no internet access but it works fine otherwise. It's only outlook that's has a problem because it defers to ncsi and doesn't bother checking itself.

 

I tried a reset from the troubleshooter, no good. I'll try the others

 

Edit: the other things haven't worked either.

Edited September 5, 2019 by browolf

[Strawdog]

The issue might not be specifically related to NetSweeper - https://community.spiceworks.com/topic/2131702-limited-connectivity-indicated-but-internet-works

[Smed]

Ok it's Netsweeper. The AP's try to download the firmware but are failing becuase the URL for the FW is https. If i SSh into the AP's and manually update the firmware via CLI and remove the S from https firmware URL, it'll download and update.

 

i wondered why mine wouldnt update!!

[Strawdog]

Anyone had any joy getting anything slightly approaching a useable report out of it?

 

The search decryption seems to be working alright but the Prevent report is absolute crap (e.g. lancashiresafeguarding.org.uk and gatesnfences.com flagged as pornography, caraudiodirect.co.uk and enviroelectronics.co.uk flagged as weapons, msn.com flagged as extreme, etc.) :\

Edited September 16, 2019 by Strawdog

[Joanne]

I've found the reports unusable. I thought that was one of the draws of changing filter too!

 

Sure they are quick to run, but the output is utter garbage.

[ticktock]

We found the other day that kids could access youtube by doing a google search in chrome. By clicking on the results it let you in even though BTLS were supposed to have blocked it. They said it was a known issue but hadn't bothered to tell anyone.

[Joanne]

I e-mailed in regards to an app that was being blocked. I got absolutely nothing back from them, but the app works now, so I assume that they fixed it.

 

Really wish they had sent me a quick ping to tell me though.