Sophos XG Vs Chromebooks

[dlomas]

Hello! We have a new xg utm, we also have a few Chromebooks, we want the chromebooks to be presented with their normal login to g suite prompt, then drop to a captive portal due to them not auth'ing on the domain. We can put exceptions in to do this, but the exceptions are to broad and open up lots of sites.google.com/sites/ sites which students are then using to access games, does anyone know the accurate narrowed down exceptions for us to achieve this?

Thanks!!!

[DGardiner]

Hello! We have a new xg utm, we also have a few Chromebooks, we want the chromebooks to be presented with their normal login to g suite prompt, then drop to a captive portal due to them not auth'ing on the domain. We can put exceptions in to do this, but the exceptions are to broad and open up lots of sites.google.com/sites/ sites which students are then using to access games, does anyone know the accurate narrowed down exceptions for us to achieve this?

Thanks!!!

 

youre gonna have to get the full list from google then sit and make educated decisions on which are actually required for the login proccess. 10 minutes with some logs and a chromebook should get you what you need

[Jaan]

Not an answer to the question you asked.....

 

But you can install a chromebook extension for AD auth

 

https://support.sophos.com/support/s/article/KB-000038431?language=en_US

[dlomas]

I get the watch the logs and put the exclusions in, but aren't there explicit exclusions for Chromebook login pages? Allowing sites.google.com/sites isn't viable as it has 100s of subsites allowing games.

 

Thanks!

[dlomas]

Oh and we don't want to use SSO for Google, we're forcing the school to move from Google small tenancy to 365, if I change Chromebook Auth to azure Auth would that solve my problems as we have successfully allowed 365 and all of it domains/subdai s

 

Thanks again...

[Wave9_Lee]

Hello! We have a new xg utm, we also have a few Chromebooks, we want the chromebooks to be presented with their normal login to g suite prompt, then drop to a captive portal due to them not auth'ing on the domain. We can put exceptions in to do this, but the exceptions are to broad and open up lots of sites.google.com/sites/ sites which students are then using to access games, does anyone know the accurate narrowed down exceptions for us to achieve this?

Thanks!!!

Hi

 

couple of links that might help;

 

setting up hostname allowlist

 

https://support.google.com/chrome/a/answer/6334001?hl=en&ref_topic=3504941

 

troubleshooting sync etc;

 

https://support.google.com/a/users/answer/2622308?hl=en

 

Chromebooks don't like having SSL inspection turned on but the following XG exceptions can be added to allow them to work

 

^([A-Za-z0-9.-]*\.)?1e100\.net1/

^([A-Za-z0-9.-]*\.)?accounts\.google\.com/

^([A-Za-z0-9.-]*\.)?accounts\.google\.co\.uk/

^([A-Za-z0-9.-]*\.)?gstatic\.com/

^([A-Za-z0-9.-]*\.)?accounts\.youtube\.com/

^([A-Za-z0-9.-]*\.)?clients1\.google\.com/

^([A-Za-z0-9.-]*\.)?clients2\.google\.com/

^([A-Za-z0-9.-]*\.)?clients3\.google\.com/

^([A-Za-z0-9.-]*\.)?clients4\.google\.com/

^([A-Za-z0-9.-]*\.)?commondatastorage\.googleapis\.com/

^([A-Za-z0-9.-]*\.)?cros-omahaproxy\.appspot\.com/

^([A-Za-z0-9.-]*\.)?dl\.google\.com/

^([A-Za-z0-9.-]*\.)?dl-ssl\.google\.com/

^([A-Za-z0-9.-]*\.)?gvt1\.com/

^([A-Za-z0-9.-]*\.)?gvt2\.com/

^([A-Za-z0-9.-]*\.)?gvt3\.com/

^([A-Za-z0-9.-]*\.)?gweb-gettingstartedguide\.appspot\.com/

^([A-Za-z0-9.-]*\.)?m\.google\.com/

^([A-Za-z0-9.-]*\.)?omahaproxy\.appspot\.com/

^([A-Za-z0-9.-]*\.)?pack\.google\.com/

^([A-Za-z0-9.-]*\.)?policies\.google\.com/

^([A-Za-z0-9.-]*\.)?safebrowsing-cache\.google\.com/

^([A-Za-z0-9.-]*\.)?safebrowsing\.google\.com/

^([A-Za-z0-9.-]*\.)?ssl\.gstatic\.com/

^([A-Za-z0-9.-]*\.)?tools\.google\.com/

^([A-Za-z0-9.-]*\.)?googleapis\.com/