DFE Chromebooks and on site web filter issues (SOPHOS XG)

[Jaan]

Hi all,

 

Like most of you in the UK we have received a number of Google Chromebooks from the DFE for our vulnerable students.

 

We use Sophos XG and web filtering on site.

 

We've set the chromebooks up following the guides and have cisco umbrella setup and working. The extension is setup and installed on a user OU in the domain/Gadmin Panel.

 

We started to have reports that the chromebooks around the school were running slow...... on investigation, it was only the students that had dfe Chromebooks (at home) that were affected. The cisco umbrella is installed against a user OU, so when the student logs into a school based chromebook, cisco umbrella is also being installed.

 

This is hugly slowing down the Chromebooks ability to access the internet onsite. If a different user logs into the Chromebook that is not a dfe chromebook user....... no issues.

 

PLugging our onsite Chromebook into our "dirty lan" with a DFe user and there's no issues. cisco umbrella filters the websites.

 

Anybody else experiencing this?

[Wave9_Lee]

Hi all,

 

Like most of you in the UK we have received a number of Google Chromebooks from the DFE for our vulnerable students.

 

We use Sophos XG and web filtering on site.

 

We've set the chromebooks up following the guides and have cisco umbrella setup and working. The extension is setup and installed on a user OU in the domain/Gadmin Panel.

 

We started to have reports that the chromebooks around the school were running slow...... on investigation, it was only the students that had dfe Chromebooks (at home) that were affected. The cisco umbrella is installed against a user OU, so when the student logs into a school based chromebook, cisco umbrella is also being installed.

 

This is hugly slowing down the Chromebooks ability to access the internet onsite. If a different user logs into the Chromebook that is not a dfe chromebook user....... no issues.

 

PLugging our onsite Chromebook into our "dirty lan" with a DFe user and there's no issues. cisco umbrella filters the websites.

 

Anybody else experiencing this?

 

Not my area of expertise (not much is tbh) but perhaps it's something on your umbrellla policy or google management - i.e. does the device or umbrella know it's on the inside of your school network and applying a different policy? They could be being filtered/scanned twice? If you don't have access to Umbrella config, perhaps you can set the XG to let the devices through unfiltered as a test?

 

Have the DFE devolved any of the Umbrella admin to schools, or is it one size fits all and they are expected to be direct internet connected rather than proxied etc?

 

Also, is the school connected to a direct internet service, or through an aggregated WAN? Again proxy and NATing could have an effect.

[Jaan]

 

Have the DFE devolved any of the Umbrella admin to schools, or is it one size fits all and they are expected to be direct internet connected rather than proxied etc?

 

I don't have access to it. unless i've missed something in the DFE guides. i suspect this is where the issue lays also

[Wave9_Lee]

I don't have access to it. unless i've missed something in the DFE guides. i suspect this is where the issue lays also

 

Perhaps fix the IPs of the DFE chromebook and let them out unfiltered, to see if they behave better as a test?

[Jaan]

Perhaps fix the IPs of the DFE chromebook and let them out unfiltered, to see if they behave better as a test?

 

It's not the DFE chromebook that the user is using. These are onsite chromebooks, where the user has a dfe chromebook at home. As such the cisco umbrella extension is installed against their user profile and then installing on the school Chromebook

[localzuk]

This would be an issue with any extension based filtering on a Chromebook - extensions are installed on a user basis, not device. So, if a user is assigned to have that extension, they'll get it on any Chromebook (and on any Chrome browser they sign in to also).

 

I'm not sure how you'll resolve this one, other than telling the children that have the DfE chromebooks to bring them in for use in school, putting them on their own IP range, excluding from normal filtering in Sophos XG and then put those users in their own OU with the extension installing.

[Jaan]

Still having issues with this.

 

I have reached out to Dfe support and had the below response. (bottom of post)

 

They seem to suggest that the cisco extension should be installed to a device OU not a user OU. However i pretty sure that it doesn't work like that and apps/extensions are purely user OU based. (unless in kiosk mode maybe?).

 

I've also managed to secure a small number of Sophos Mobile licenses and tested that works on the Chromebooks and filters fine both on/offsite DFE chromebooks (once cisco is removed of course).

 

------

 

 

Hi Jaan,

 

There isn't anything we can do in Cisco Umbrella as it is a platform that is used by Hundreds of thousand children around the UK and has been configured to meet the broadest user base with the best level of protection.

 

Chrome policies set in the admin console are applied in the order of Device, Machine-Level, User, Browser, as per this help article, so if you were to put the school's Chromebook devices in an OU that didn't allow the installation of Cisco Umbrella, then regardless of which student used the device Umbrella wouldn't be installed on it.

 

I hope this helps but please don't hesitate to ask if you need any further assistance.

 

Regards

DfE User Support

[Primus]

Yes extensions are pushed to users not devices.

[Jaan]

Another reply.

 

Now i'm really confused

 

 

Hi Jaan,

 

Apps and Extensions have recently moved to a new page and there is no more User apps vs Device apps but simply apps and extensions applied to OUs so if you have an OU for DfE devices and an OU for Schools devices then set the extensions and apps locally per OU as you would like them to apply.

​

 

 

 

And as per my previous response the Extensions and apps will be applied in the order of Device, Machine, User, Browser so if applied at the device level this will take precedence.

 

Regards

Dfe User Support

[Primus]

Another reply.

 

Now i'm really confused

 

 

Hi Jaan,

 

Apps and Extensions have recently moved to a new page and there is no more User apps vs Device apps but simply apps and extensions applied to OUs so if you have an OU for DfE devices and an OU for Schools devices then set the extensions and apps locally per OU as you would like them to apply.

​

 

[ATTACH=CONFIG]59760[/ATTACH]

 

 

And as per my previous response the Extensions and apps will be applied in the order of Device, Machine, User, Browser so if applied at the device level this will take precedence.

 

Regards

Dfe User Support

 

Unless I have missed a major change they're wrong - extensions are still only pushed to users not devices.

[Jaan]

My understanding is the same as yours.

[DGardiner]

Unless I have missed a major change they're wrong - extensions are still only pushed to users not devices.

 

it may be that the block takes precident, and applies to devices - should be an easy one to test either way but from what i understand it wont

[Jaan]

it may be that the block takes precedence, and applies to devices - should be an easy one to test either way but from what i understand it wont

 

In fact that's what the Dfe are suggesting. However my after testing i'm still having the issue........ Cisco Umbrella is force installed at User level...... but Blocked at Device level on the school Chromebooks.... It still presents itself to the user on a school owned device.

 

I'll make sure i've not missed anything and ensure the device policy has applied to the Chromebook.

 

----

 

Hi Jaan,

 

If you set the Extension to be blocked on the Users settings for the School Chromebooks OU then it should block that extension on the Devices.

Please do test and let me know as I can't test it on my side but i have seem this setup like this before.

 

Regards

Dfe User Support

[Primus]

So are we saying the DfE are wrong? I mean I'm massively shocked by that!

[LeMarchand]

Whilst I'm not sure that the person who set it up did it correctly (we took advantage of the free offer), we had to block it as we only had 2 DfE devices and Cisco was messing with our ability to use Google Classroom. The head had a word with the two sets of parents and, I think, got them to sign something. TBH, we can't stop kids doing whatever they like on their own devices so, while filtering would be nice, we didn't see it as critical.

[Jaan]

Whilst I'm not sure that the person who set it up did it correctly (we took advantage of the free offer), we had to block it as we only had 2 DfE devices and Cisco was messing with our ability to use Google Classroom. The head had a word with the two sets of parents and, I think, got them to sign something. TBH, we can't stop kids doing whatever they like on their own devices so, while filtering would be nice, we didn't see it as critical.

 

We have 140 of them lol

[Jaan]

Looking at Google documentation https://support.google.com/chrome/a/answer/9037717?hl=en

 

2. Machine-level cloud policies

Apply to Chrome Browsers enrolled in Chrome Browser Cloud Management.

Take precedence over OS user and Chrome profile settings made in the Admin console.

Are set using the Admin console.

 

So sounds like it might work. I'm gonna give it another go........

[Jaan]

I've tried this again and its defo not working......

 

If also used chrome://policy to force both user and devices policies to update.

 

Cisco is set to be installed at user level:

 

 

Then it's blocked at device level;

 

 

And yet when one of our DFE students logs into one of our onsite chromebooks...... the cisco app is installed and everything goes super slow.

 

I Think the Dfe are wrong.

[Primus]

I've tried this again and its defo not working......

 

If also used chrome://policy to force both user and devices policies to update.

 

Cisco is set to be installed at user level:

 

[ATTACH=CONFIG]59785[/ATTACH]

 

Then it's blocked at device level;

 

[ATTACH=CONFIG]59786[/ATTACH]

 

And yet when one of our DFE students logs into one of our onsite chromebooks...... the cisco app is installed and everything goes super slow.

 

I Think the Dfe are wrong.

 

I think so too - extensions have always been related to users not devices.

[Jaan]

Looks like us Edugeekers were right....... you start questioning yourself sometimes! however I don't agree that this scenario/issue isn't a "Common problem".

 

-------

 

Hi Jann,

 

After doing a bit more research I have found out that what I was hoping to do isn't possible.

Extensions and Apps are assigned at the user level and can't be controlled at the device level, hence the confusion, it's a bit difficult not having the same environment this side to be able to test with.

Unfortunately I am unable to offer any further advice on how you could get around your issue. It's not a common problem where a user would have access to 2 devices with different networking restrictions in place and one of them being imposed through Chrome policies and the other not.

 

Regards

Dfe User Support

[Primus]

Looks like us Edugeekers were right....... you start questioning yourself sometimes! however I don't agree that this scenario/issue isn't a "Common problem".

 

-------

 

Hi Jann,

 

After doing a bit more research I have found out that what I was hoping to do isn't possible.

Extensions and Apps are assigned at the user level and can't be controlled at the device level, hence the confusion, it's a bit difficult not having the same environment this side to be able to test with.

Unfortunately I am unable to offer any further advice on how you could get around your issue. It's not a common problem where a user would have access to 2 devices with different networking restrictions in place and one of them being imposed through Chrome policies and the other not.

 

Regards

Dfe User Support

 

Well blow me down with a feather the DfE were wrong!

 

Yeah I'd say it's quite a common issue.