Smoothwall Network Guardian Negatives?

[ssiruuk2]

Sorry not a negative for Smoothwall and don't want to hijack the thread but heres a tip if you do decide to move from Websense; make sure you backup any custom web lists you have created before your renewal date. I found out the hard way that when your license expires you have no way of getting them back which did annoy me alot!

 

Websense support were not interested in helping me which I guess from their point of view makes sense but I was not happy having been a customer with them for 5 yrs +.

Edited March 11, 2009 by ssiruuk2

[tom_newton]

Will let our support folks know, we're trying to put together some "migratiob packs".

 

ssiruuk2: Would you do us a case study? If you'd be up for it, drop me a PM (and anyone else who thinks they might like to for that matter)

[Sylv3r]

We've had issues this week high loads - low disk space etc, we had no internet today because of it but a phonecall to smoothwall had us up and running in about 30 mins. They are running further tests on our box tonight due to some other strange errors, but I am confident they will get us sorted.

 

Its OK when our internet connection goes down the staff just blame our ISP - so smoothwall didn't get the blame today either ) I was panicking a little as we were running a course this afternoon which needed an internet connection - I thought we were going to have to dust our old proxy server down and get it warmed up.

[ssiruuk2]

Sorry guys but heres another negative, well I think so anyway ...

 

We bought a 3 yr subscription to Smoothwall School Guardian but only get 12 months support.

 

When I was a Websense customer (boooooo!) if you buy a subscription for however many years you get support for the entire length of the subscription. (And you bloody well needed it with the amount of time the logging engine would stop for no reason!)

[ICTNUT]

I would agree, if you buy into a 3 year contract I would expect to get 3 years of support also.

 

BLOXX did do this but then, just like websense, you REALLY did need it.

 

I think knowing what you are getting right from the start is a good thing, a clear pricing policy can only be a winner.

[ssiruuk2]

I would agree, if you buy into a 3 year contract I would expect to get 3 years of support also.

 

BLOXX did do this but then, just like websense, you REALLY did need it.

 

I think knowing what you are getting right from the start is a good thing, a clear pricing policy can only be a winner.

 

Exactly. It would be good to know from the off what the cost of support is going to be for our second and third year. Or of course, Smoothwall could just offer the same support deal as Websense / Bloxx for educational customers

[tom_newton]

Sorry guys but heres another negative, well I think so anyway ...

 

We bought a 3 yr subscription to Smoothwall School Guardian but only get 12 months support.

 

When I was a Websense customer (boooooo!) if you buy a subscription for however many years you get support for the entire length of the subscription. (And you bloody well needed it with the amount of time the logging engine would stop for no reason!)

 

We don't do 3 year support contracts because:

a) you might decide you want to downgrade or upgrade your level after one year

b) support costs fluctuate, as do our offerings (ie. longer hours etc.)

 

I will make sure the sales folk make this clear. I suppose if you *really* wanted to do support for 3 years as well we could manage to put something together.

[ICTNUT]

We don't do 3 year support contracts because:

a) you might decide you want to downgrade or upgrade your level after one year

b) support costs fluctuate, as do our offerings (ie. longer hours etc.)

 

I will make sure the sales folk make this clear. I suppose if you *really* wanted to do support for 3 years as well we could manage to put something together.

 

 

Tom please don't take this as a bad negative, if such a thing exisits.

 

I have/will by into an annual contract with Smoothwall but the only reason for this is due to the royal shafting I got with the other filter.

 

However I can apreciate that some people may want to buy into a longer term contract and they may have the need to set budgets for the next [x] number of years so at least they will know exactly what to expect in years 2, 3 and so on.

[mb2k01]

Slightly naughty of me to bump this thread to the top again, but a lot of you were very helpful when I posted the thread, so I thought I'd post an update for those that are interested.

 

I'd arranged to evaluate Network Guardian when the new release was available, and after asking various questions about appropriate hardware spec and what would be needed + making a firewall change with our ISP (to make sure the Smoothwall client itself wasn't getting a filtered connection) I was ready to go.

Today was day one of our evaluation.....

 

Unfortunately I'm no further forward than I was this morning (in fact technically further behind than I was this morning!)

 

I was told that all I needed was a client with a decent dual core processor, decent amount of RAM and decent Hard drive - so this morning proceeded to unpacking a brand new Acer Veriton (I have a couple in the office ready for replacements / swap-outs!)

 

1st problem - installation could detect USB storage device (turned out to be front USB + card reader - so whipped the side of and unplugged it!)

 

2nd problem - Couldn't find storage interface - rang support - very helpful (as all previously said here) and found it might be an EHCI issue - asked to search BIOS for relating settings and disable.

 

3rd problem - Not really any EHCI settings, but a few SATA related settings, so proceeded to change some settings on a trial and error basis - nothing working so called support again.

It was suggested that chipset may be issue and that SATA wasn't helping, so proceeded to put an IDE drive in there!

 

4th problem- Get past the stage where installation said a storage device wasn't there, but not have CD drive not present, and the message also says a NIC driver can't be found! (I assume the CD issue is because that is SATA too - Not got as far as the NIC). Ring support again. Suggested that I download Fedora and run from CD on this station to give some output/technical detail.

 

5th problem - Fedora won't run! Get the boot screen, but then go to a completely black screen with no activity. Get bored after about 30min and try again. Same happens, so phone support. Suggested that I try an experimental install from a USB key. Proceed to download iso and app to do this

 

6th problem - can't mount the image to the disk. It's either permissions based (running Vista which hasn't been tested) or something else. Try a different computer and find the USB device is now dead!

Reformat the USB device, but then suggested I run Fedora on my workstation (not the one we've previously tried and failed).

 

7th problem - Fedora won't run on my workstation (completley different hardware to the evaluation server I chose - Stone Computer, Intel Motherboard, about 1-2yrs old)

 

Ending advice = find new hardware.

Well... I've picked two reasonable bits of kit within my enviroment and neither will work. If I buy anything newer is it going to work?

 

This post is not really a dig at support - the guy on support who dealt with me all today was very professional and understanding - always called me back when he said he would, always there when I picked up the phone - just ultimately not actually able to help me get anything working here today.

 

Summary - you could say today has been a pretty bad day.

The only other actvities I've carried out today are point out to supposedly highly-educated members of staff common sense resolutions to silly jobs, or done the usual thing of doing their jobs for them!

 

Not sure if i'll go any further with this evaluation. It went from extremely positive comments -> extremely good live demonstration -> most frustrating 7hrs i've had in quite some time!

 

Maybe life will look rosier after a decent meal, some cocodomal (banging headache!) and a game of Fifa!

 

Oh - I got a promotion today lol. That's good. (Maybe i'll just delegate this instead!)

[andyrite]

Download a copy of vmware server and install it as a vm. Work's just as well. LInux can be a right pain with some hardware. If you don'y want any issues with hardware, have a look at the utm.

[ssiruuk2]

If you want to do this cheaply on a new physical box then just go buy yourself a HP Proliant ML110 server - £200, dual core AMD and 2gb RAM, thats what I have installed our Smoothwall on - works perfectly and ours takes an absolute pounding (1800 users)

 

You do need to disable the top option under hardware when in the Setup for Smoothwall to get it to install correctly though (cant remember what its called now)

[john]

Must admit this is the exact reason I went with the UTM appliance as I assume that Smoothwall have designed them to ensure 110% compatibility with there software and hope that as they will continue to accept maintenance cash from me in the coming years that they will ensure in the coming years that my investment in the appliance will continue to be fully supported by the updates in the software in the future.

[Danielbarron]

I was told that all I needed was a client with a decent dual core processor, decent amount of RAM and decent Hard drive - so this morning proceeded to unpacking a brand new Acer Veriton (I have a couple in the office ready for replacements / swap-outs!)

 

Sorry you've had so many troubles.

 

That machine sounds like a desktop PC? Generally one might have more success with servers with SmoothWall. Desktops tend to use the latest cheapest nic, controllers and so on. The amount of change in these type of devices makes it hard to keep up with drivers. We try to keep up with server hardware and main brands like Intel and generally do a good job but there is always a latest version that someone might find.

 

SmoothWall uses Linux at its core and if no Linux drivers exist it makes it impossible to support.

 

The other replies are good - using a UTM or VM removes hardware issues. Alternatively we could pick up your hardware, if you can lend it to us for a couple of weeks, and see if we can make a driver disk?

 

(We means SmoothWall - I work for them.)

 

I've not looked at your ticket but judging by the time of the post I assume all possible remote ideas have been attempted.

[dave.81]

Have to say i had the same problem when i was on a trial trying to use a desktop pc. We where 95% sure we would go with SG even before the trial and i did the crazy thing of installing it over the old proxy (praying it was the solution to fit our needs) and well here we are 2 years later with it still on there. Although it did get reinstalled once when the HDD failed.

 

Have to agree that the reporting can be a bit fiddly but looking forward to the new updates to see how it's improved. We never actually took out the support just used the 30 days that came with it when purchased, never needed support since but more than happy to pay if and when we do.

[mb2k01]

Sorry you've had so many troubles.

That machine sounds like a desktop PC?

 

Indeed.

It exceeded the specification I was given, so didn't anticipate problems.

I'm unlikely to purchase a server for the purposes of a 30 day evalutation.

[plexer]

What about installing vmware on that desktop and testing it within the vm, smoothie works great on server class hardware.

 

Ben

[mb2k01]

That's my next step as a last ditch effort.

Do you recommend VMware over Virtual PC? (I've never used VMWare)

[plexer]

vmware.

 

Ben

[contink]

I've found that the best boards to install any form of smoothwall on is one that's a few years old. Often the drivers are all available, incorporated in and will work fine.

 

Getting a server at this point is overkill and tbh probably not even necessary...

[tom_newton]

It is *possible* to run smoothie under other virtualisation environments than vmware, but vm is the only one actually supported. Believe we have a few successful hyper-v users about, never tried virtual PC.

 

I would echo Dan's comment that desktop hardware is generally considered difficult to support - if you really are short of spare tin, it is usually possible to evaluate one of our appliances.

[cookie_monster]

We had a trial today and are very impressed so we are looking into some hardware to run it on currently, can someone tell me a bit about the Smoothwall UTM appliance does this cost more than say a licence and general server or does it offer different features?

 

Thanks.

[tom_newton]

cookie: price wise, you won't find a lot of difference I expect. Feature wise, it is much the same except the UTM has more network i/faces, and they are front mounted. You also don't have to install any software, of course. Personally, I have a hard time choosing which is the best option - which is why we offer both. If you already had hardware or have pre-existing favourable purchasing on hardware... id probably go with that, if you don't the UTM is a nice box!

 

Give me a ring tomorrow (am on train home from infosec now!!) if you want to do some pro-ing and con-ing in more detail!

[john]

As a UTM Customer (sorted two out now) I didn't notice a real difference in price between buying a decent speced server with the same number of interfaces and performance as the UTM etc. Plus my view point was if Smoothwall sell the UTM and Software then I would hope that its 1110% compatible with it and they always ensure that it is otherwise they will have very angry customers was my view.

[whoopus]

I have only one negative that maybe you guys can help me with. That negative is an apperant incompatibility with Internet Explorer in some areas.

 

We are currently evaluating Network Guardian on our server hardware (an HP DL360 G3 with dual xeon 2.8s, dual nics and 4 gb memory.) Last year we used the "lite" version of Surf Control built into our Firewall. It was so bad we had to use monthly "shock and awe" campaigns by scanning the logs for a few violators to scare the kids into thinking that we were watching them all of the time. Not very effective...

 

Basic browsing with Internet Explorer (we have tried v7 and v8) works fine. The user authenticates and they get the pages they should and are blocked at the pages they shouldn't.

 

But we get a username/password prompt when we try to attach a file to a gmail message. The IP address is that of the Smoothwall server, but no matter what username and password we use, we can't get through. The browser locks up. If we cancel the logon prompt, the attachment simply fails, but the browser doesn't lock up. What is weird is if we log into gmail with https, we have no problems....I guess because we have https intercept turned off. There obviously are workarounds (tell SW to not authenticate/cache on visits to gmail.com or have gmail force https), but I really don't like workarounds.

 

Also, if a page is blocked, and I try to allow the site for 30 minutes, I get to the SW login where I enter the admin username and password. After I submit my admin logon credentials, I then get a 400 error page that says "This error (HTTP 400 Bad Request) means that Internet Explorer was able to connect to the web server, but the webpage could not be found because of a problem with the address."

 

 

Several calls to SW support has them blaming Microsoft, which may be true. Firefox doesn't present with these problems, but I cannot force all of my users to switch to firefox. Am I the only one having these issues?

 

This is a real shame, because other than these problems, this system and it's reporting is great!

 

BTW, I am using Network Guardian 2008 with the latest updates installed and I am authenticating against AD (windows 2003 server) using Kerberos.

 

Thanks for any help or further insight.

 

Mark

[ICTNUT]

Hi Mark,

 

I'll try and disect your questions,

 

Also, if a page is blocked, and I try to allow the site for 30 minutes, I get to the SW login where I enter the admin username and password. After I submit my admin logon credentials, I then get a 400 error page that says "This error (HTTP 400 Bad Request) means that Internet Explorer was able to connect to the web server, but the webpage could not be found because of a problem with the address."

 

The issue here is that you need to add the IP address and/or the FQDN of the smotthwall box to the proxy bypass in IE. What is haapening is that the bypass page is being proxy'd and filtering itself and kind of getting caught in a loop

 

But we get a username/password prompt when we try to attach a file to a gmail message. The IP address is that of the Smoothwall server, but no matter what username and password we use, we can't get through. The browser locks up. If we cancel the logon prompt, the attachment simply fails, but the browser doesn't lock up. What is weird is if we log into gmail with https, we have no problems....I guess because we have https intercept turned off. There obviously are workarounds (tell SW to not authenticate/cache on visits to gmail.com or have gmail force https), but I really don't like workarounds.

 

Sounds to me like its file security on http for the group that is accessing GMail. I would try the following:

1 - If GMail is an allowed site see if adding a permanent bypass for the required group will work.

2 - If you don't want to do this have a look at the smoothwall file security policy to see if that is blocking you.

 

Several calls to SW support has them blaming Microsoft, which may be true. Firefox doesn't present with these problems, but I cannot force all of my users to switch to firefox. Am I the only one having these issues?

 

Yes and no, IE is quirky and can present problems but most of these can be worked around and I am sure that scores of others that use this product on here (like me) will be able to tell you the same. I have had the same issues you have and have resolved these and more and they have all been to do with IE. The schools we support do not have another browser to use as it is policy ONLY to use IE so we have had to "fix" them.

 

What you need to remember is that out of the box "by default" the network garudian install is restrictive, this is by design and will need tweaking to get it right for your school.

 

Yes it's easy to install, and do basic configuration but you do need to spend some fine tuning.

 

Shout if you need anymore help

Edited June 23, 2009 by ICTNUT