Filtering solution for BYOD

[pablo007]

Hi all,

I am looking for an internet filtering solution for our 6th form BYOD network, ideally, it would be fully transparent (no proxy settings, ports certificates, etc.)so that I don't have to do anything on end devices to allow them to connect, or it would have some sort of portal that they could enter a username password to gain access.

Can anyone recommend anything, not too bothered if its on-premise or cloud-based.

 

As always thanks in advance.

[mavhc]

Impossible, that's what TLS is designed to stop happening.

 

You could log the ip addresses visited and match those to users, that's it

[SchoolsBroadband]

@Mavc isnt quite right. He is correct if you want to do https decryption but if not then most transparent firewalls should do this if they come with content filtering.

 

Our hosted netsweeper platform does this out of the box.

 

Dave

[Primus]

@Mavc isnt quite right. He is correct if you want to do https decryption but if not then most transparent firewalls should do this if they come with content filtering.

 

Our hosted netsweeper platform does this out of the box.

 

Dave

 

Given the context he's not wrong - you cannot seriously be suggesting allowing students to use the Internet without doing HTTPS interception in the year 2020?!

[SchoolsBroadband]

I would never suggesting doing that no. But some schools do.

[Securly_Chris]

Hey Pablo007,

 

We have a guest/BYOD mode available on our cloud DNS filter which doesn't require certificates installing. Or a self-serve certificate installer if you decide you need HTTPS covering on BYOD too.

 

Takes about 5 mins to setup if you want to test it out! Drop me a PM and I'll be happy help out.

[Wave9_Lee]

Hi all,

I am looking for an internet filtering solution for our 6th form BYOD network, ideally, it would be fully transparent (no proxy settings, ports certificates, etc.)so that I don't have to do anything on end devices to allow them to connect, or it would have some sort of portal that they could enter a username password to gain access.

Can anyone recommend anything, not too bothered if its on-premise or cloud-based.

 

As always thanks in advance.

 

Hi @pablo007

 

Sophos XG can do this. On-prem, and can obviously deal with all your other firewall/filtering requirements too. The captive portal can publish a certificate too if https is required further down the line.

 

cheers

[mavhc]

Also once DNS over HTTPS becomes standard, DNS based filtering is dead, if you want something that'll work in 5 years time, need to install a MITM CA on every device for filtering that will actually work

[robyholmes]

As a lot are suggestion, you need HTTPS inspection otherwise your blind to a large amount of traffic. Serving the certificate on the BYOD is the best approach.

[ibpalle]

Plus one for implementing HTTPS inspection. Certificate Authority distribution can be made easy by having multiple vectors - link on login pages, link on school homepage, email to new users - don't just use one option. Without HTTPS inspection the filter is basically just a token measure in my opinion. Also remember that while installing the CA is needed for validating certificates, it's technically not required - it will be massively inconvenient with tons of certificate warnings and some browsers will complain more, but access can still work.

[pablo007]

I think we are going down the route of cisco umbrella for our chromebooks off site (we manage them) and for all else we have gone down the route of a traditional paid for schools proxy delivered via wpad and proxy pac file, as the proxy only has one port for all so it should be fairly straight forward, we are using unifi guest wireless which stops inter vlan traffic.