Odd internet issue possibly smoothwall related

[steveg]

We have a really odd internet issue affect at the moment only 1 type of computer (which happens to be our class whiteboard computers)

 

Intranet and browsing of sites which we have set not to inspect on smoothwall work fine. If the website is to be inspected but allowed, it just tries for ages and never loads, youtube for example. If I pull the network cable after 10 minutes some elements of the site have loaded, like it was taking a really long time but it's definitely not actually loading.

 

It's not every single one of these computers but most (10 out of 15 roughly at the moment) 1 user reports it has happened for them all week, most just today.

 

I re-imaged a spare identical computer and it seemed to work fine, took it to the classroom and it worked fine for an hour this afternoon, now presents the same issue.

 

The computer from their room I took back to my desk then started working ok. I have checked switches and moved to different ones - the computers affected are also spread all over the school.

 

Have re-started the smoothwall box, on live monitoring I can't see it blocking anything from the affected computers. They use a transparent proxy, smoothwall is in bridging mode.

 

I tried a usb network adaptor in one computer, still has the same issues.

 

Starting to run out of ideas!

[steveg]

Might have solved it, well at least found the issue. Have removed Senso off 2 computers and so far both are working fine.

[ibpalle]

I may be incorrect here but I think Senso does HTTPS inspection as well. Applications generally have a hard time with HTTPS inspection which is why their target domains often have to be excluded from HTTPS inspection. With both Senso and Smoothwall in place, it may be needed to install the Senso Certificate Authority on the Smoothwall in system - certificates - certificate authorities so Smoothwall can validate certificate created by Senso.

[steveg]

I may be incorrect here but I think Senso does HTTPS inspection as well. Applications generally have a hard time with HTTPS inspection which is why their target domains often have to be excluded from HTTPS inspection. With both Senso and Smoothwall in place, it may be needed to install the Senso Certificate Authority on the Smoothwall in system - certificates - certificate authorities so Smoothwall can validate certificate created by Senso.

 

Thanks. I'll log a call with Senso, it's been working fine for a couple of years but decided to just stop this week. It does do some web filtering but i'm not sure how exactly.

[steveg]

In case anyone else is having the same issue, Senso have advised logging a call with Smoothwall. So far it appears to be that Senso have updated to TLS 1.3 which smoothwall doesn't yet support.

 

I have a ticket open with smoothwall which Senso are also contributing to, hopefully to find a resolution.

[cstreet]

I can confirm that this has impacted all of our schools - and it's a Senso change/update that initiated the problem, not Smoothwall.

 

Senso have updated the Senso WFP filter drivers on Monday 17th April. These drivers are using TLS 1.3 - claiming to be backward compatible however aren't working with Smoothwall TLS 1.2.

 

We noticed that YouTube stopped loading yesterday morning on some clients, getting worse as the day went on (as more and more Senso clients updated).

 

While Smoothwall should be working with TLS 1.3 by now, they are probably holding fire until their new release, which will be properly tested before launching into the wild. No point asking Smoothwall for support here, it's caused by Senso.

 

We have a temporary work around by disabling the Senso filter drivers. This removes some features of Senso but allows the basics and also all HTTPS inspection now working. Please seek support from Senso to ask if you need this temp fix for your environment.

 

Senso on the released an impactful driver update that clearly hasn't been tested with Smoothwall customers. I'm disappointed, for the second time. We've had this before when it was clashing with Sophos. Not impressed but happy that Senso are working on it with us directly.

Edited April 19, 2024 by cstreet

[steveg]

I currently have tickets going back and fourth between the 2. Senso say they need to support TLS 1.3 to align with best practice and comply with other vendors who are already running 1.3. Smoothwall have said that although the plan to support 1.3 at some point, they have no timescale for this at the moment.

 

I can see Sensos need to update, but pushing this out with no warning when it is going to cause a significant amount of issues to a lot of schools is not good practice.

[cstreet]

Senso DEV team are currently working with one of our machines to see if they can fix the backwards compatibility or provide some sort of working setup.

 

Our school environments are all the same with:

 

- Sophos Enterprise Cloud installed on all Windows clients with HTTPS inspection enabled

- Smoothwall Appliance on Leeds 73 (latest)

- Smoothwall Proxy configured on clients with HTTPS inspection (full decrypt and inspect of sites unless whitelisted in Smoothwall)

- Many common sites that are whitelisted in Smoothwall also whitelisted in Senso monitoring (by domain/URL in a massive uncategorised list)

- No smoothwall software or drivers are installed on Windows client (upstream proxy only)

- Senso Cloud client installed on every Windows client (currently with filter drivers disabled and features lost)

 

Before the Senso driver update on Monday everything was working together.

[tom_newton]

TLS1.3 I believe is challenging to support when doing MiTM (it's easy enough to support on the upstream leg, which we do).

[Matt007a]

I've been chatting with both Senso and Smoothwall and 2 months on this still isn't resolved for us. The disablefilter file does work, but without the dedicated teacher pc functionality, Senso is pretty useless to us. The main purpose of it is to give the teachers management of the PCs in their room.

 

Neither Senso nor Smoothwall are actively looking to fix this. I've been told by smoothwall I simply can't use both products and Senso are not going back to TLS 1.2.

 

I don't suppose anyone else has had any more luck?

[tom_newton]

Im afraid there's not a lot we can do about it - as I said it makes upstream MiTM challenging if you cant force a downgrade to 1.2 on the local leg. Our in-browser filtering would solve the issue if you wish to use both? Or if you are only using senso for Monitoring let me know and we can probably get you a solution that works.

[Matt007a]

Hi Tom,

 

We would definitely want the "Dedicated Teacher PC" function of Senso working. The teachers like the ability to see kids screens, lock them, broadcast to them etc. None of which are available in it's current state.

 

The only way to get it working is to disable HTTPS inspection and decryption in Smoothwall, but that leaves us too open to kids getting on sites they shouldn't be on.

 

By in-browser filtering, do you mean a chrome extension being installed like the cloud filtering?

[tom_newton]

Hi Tom,

 

By in-browser filtering, do you mean a chrome extension being installed like the cloud filtering?

 

I do indeed.

 

If you want to drop me an email i'll see what we might be able to do to find all the stuff you need in various different ways.