Offsite filtering for single student - Fortinet

[mdrabble]

Just been ask to provide a laptop for a student who will be off site for a couple of weeks.

 

Laptop itself not an issue as can be sorted using intune.

 

The problem I have is providing offsite filtering.

 

Currently using Fortinet, have VPN in place for staff using a split tunnel,so how would i get this single laptop to connect automatically to the VPN and send all traffic throught the VPN to ensure filtering takes place?

 

Or suggestions welcome.

 

Cheers

[Steve101]

Do you use Senso?

[tom_newton]

I think automatic VPN with no split tunneling is probably your best bet. That, I am sure is something forti users do all the time

 

Alternative: use some family filter software like Qustodio. Arguably a bit more work for the DSL checkig an individual's report... but all depends what you have available to you

 

[next time you are renewing, think of us - this would be a 2 min job in the SW filtering world]

[itskdog]

Microsoft Edge for Business has a rudimentary web filter, and your AV might have a web filter, too (I know Sophos and Defender both do, when scurrying during Covid to get one going on the DfE laptops with, I used ).

 

LGfL schools have HomeProtect (NetSweeper like on-site, just as an installed application, and a much more basic UI) which is included free with your broadband (it's not made clear in the marketing that it's free, but it seems to be, and certainly was for us).

 

Non-LGfL schools can also get it for a fee, presumably paid per-student you're tracking, or per-device (not sure), clients are tracked by username (in your case as you're using Intune, it will use Entra SSO to identify the account, but it can also do Google and AD) for compliance with KCSiE.

 

Also as @Steve101 suggested, your monitoring solution (Senso, Classroom.Cloud, etc.) might also have a web filter, either already included or as an addon that you could purchase.

[Dipl0]

You need a cloud filter, and if you have managed student laptops or you have laptops that come into school for work you need to be cloud filtering to be fully KCSIE compliant.

 

We use lightspeed which is excellent. Smoothwall have a cloud filter but last I checked it was chrome only so you'd need to ensure you had applocker and other policies in place but even then personally you need a whole of device filter which is what lightspeed offer with their agent.

 

There's senso and many many others, I'd argue Lightspeed is the best of a bad bunch though, they all have their weaknesses. Lightspeed are also heavily developing, they've just introduced AI image filtering and also will be releasing a function to detect AI prompts and their outputs which will save me a lot of work if that is going to truly work like the way they claim it will.

Edited May 21 by Dipl0

[SchoolsBroadband]

1 hour ago, mdrabble said:

Just been ask to provide a laptop for a student who will be off site for a couple of weeks.

 

Laptop itself not an issue as can be sorted using intune.

 

The problem I have is providing offsite filtering.

 

Currently using Fortinet, have VPN in place for staff using a split tunnel,so how would i get this single laptop to connect automatically to the VPN and send all traffic throught the VPN to ensure filtering takes place?

 

Or suggestions welcome.

 

Cheers

 

From memory I think Fortinet disabled always on VPN from their free version of Forticlient. If you can want it nailed on your need to buy the paid for version and then it can do what you require by forcing all traffic via your FortiGate device and applying a filtering policy.

 

Dave

 

[tom_newton]

13 minutes ago, Dipl0 said:

Smoothwall have a cloud filter but last I checked it was chrome only so you'd need to ensure you had applocker and other policies in place but even then personally you need a whole of device filter which is what lightspeed offer with their agent.

 

You will be pleased to note we do now offer whole of device filtering and monitoring - although I would still recommend applocker, as whole of device filtering is never as accurate as in-browser filtering, where you can get access to all the content.

[mdrabble]

Yep had it confirmed the free FortiVPN client won’t do always on, need the full paid version.