Smoothwall Hybrid Cloud Filtering

[jaminben]

Morning all,

 

Anyone using this that can offer any insights into how well it works or not? Any gotchas?

 

Many Thanks

Ben

[ibpalle]

Some points to take in regarding hybrid deployment.

 

On-prem

Transparent will intercept all outgoing web traffic. Cloud clients will bypass the on-prem filter to avoid being double filtered. Various auth methods exists for users including RADIUS and our iDex system for AD accounts which will give you the option of having BYOD Wifi connection profiles with AD usernames/password so even users own devices can be filtered and logged by their right username.

 

Cloud filter extension

Extension installs on a browser (Chrome, Microsoft Edge, ChromeOS) or gets installed as a browser with the extension built in (iPads, not released yet) and will filter web access done from those browsers at all times, regardless of location.

 

Traffic already being filtered by the extension won't be intercepted by the on-prem Smoothwall, this is done to prevent double filtering. Traffic coming from on-prem clients with the extension installed but NOT coming from the browser with the extension, will be filtered by the on-prem device. That obviously won't be the case if the user is not on-prem.

 

All logs gets collected on the on-prem device and the cloud clients themselves have a realtime log viewer for easy troubleshooting.

 

Also, once the cloud filtering is deployed, you will also get access to our cloud portal that allows you to edit and maintain filtering settings remotely without logging into the on-prem Smoothwall. The portal will have other features as well like cloud reporting soon (Cloud reporting will be an add-on and have an additional cost)

[getyourfill]

I set up the hybrid cloud filtering with a small subset of users and I'm not sure it was worth it. It did smooth out the authentication process a lot, but the lack of reporting on-site really set me back. I don't think I'm getting any kind of filtering alerts now if they're doing something they aren't supposed to. I tried making some searches on a test account that would normally be flagged and give me an instant-email, but I got no such alert on the hybrid user. I didn't expect to lose all the alerting and reporting.

[ibpalle]

You are not loosing reporting but since the clients filter on the actual device, logs are collected there and sent to the on-prem device every 5 minutes. The realtime log viewer in the cloud portal that you also have access to, will allow you to see the logs for a specific active device.

 

The safeguarding alerting won't be instant, obviously due to the delay in the transfer of logs and currently they are not triggered on cloud log ingestion but that will change. The daily/weekly/monthly notification safeguard reports will contain data from the cloud filter logs.

[PotNoodleTech]

I'm inheriting this from the LEA soon. The ability to filter chromebooks etc off site sounds awesome!

[getyourfill]

You are not loosing reporting but since the clients filter on the actual device, logs are collected there and sent to the on-prem device every 5 minutes. The realtime log viewer in the cloud portal that you also have access to, will allow you to see the logs for a specific active device.

The safeguarding alerting won't be instant, obviously due to the delay in the transfer of logs and currently they are not triggered on cloud log ingestion but that will change. The daily/weekly/monthly notification safeguard reports will contain data from the cloud filter logs.

 

So I should be getting the safeguard alerts even if I'm not paying for the extra 'cloud reporting' ? If so, I'll have to test it again

[ibpalle]

The safeguard notifications (The daily, weekly, monthly ones) will show safeguarding incidents, the instant alerts won't work for cloud filter logs currently. That is underway as I understand it and it won't be dependant on cloud reporting.

[gaz350b]

If they can run Firefox that’s the least of your problems…. They can probably install all sorts to bypass filtering.

 

Get your users locked down properly.

[5tu]

Cloud Filter is working really well for us and our DSL is very happy with the safeguarding features it provides for school devices used off-site and out of school hours - gives a much more holistic view of student's online activity and has caught some priority incidents.

[tom_newton]

The safeguard notifications (The daily, weekly, monthly ones) will show safeguarding incidents, the instant alerts won't work for cloud filter logs currently. That is underway as I understand it and it won't be dependant on cloud reporting.

 

It's done Tim - it just needs enabling in the cloud portal for instant alerts, as it works differently (doesnt pass through on prem at all).

 

- - - Updated - - -

 

If they can run Firefox that’s the least of your problems…. They can probably install all sorts to bypass filtering.

 

Get your users locked down properly.

 

We do have a (very) experimental firefox build if anyone wants to try it

[gaz350b]

It's done Tim - it just needs enabling in the cloud portal for instant alerts, as it works differently (doesnt pass through on prem at all).

 

- - - Updated - - -

 

 

 

We do have a (very) experimental firefox build if anyone wants to try it

 

Seems the post I was replying to was deleted and my post now seems to make no sense!

[ibpalle]

It's done Tim - it just needs enabling in the cloud portal for instant alerts, as it works differently (doesn't pass through on prem at all).

 

Yeah, been present for a while now. Make sure to add safeguarding contacts in the cloud portal to receive notifications for cloud clients.