Transparently Filter Using Websense

[FN-GM]

Our school gets Websense for free so we would like to take advantage of this.

 

I would like to have filtering on the Guest and Student wireless network. I dont want it to use AD group or anything just filter all clients that connect. The devices that connect will be all different kinds such as Windows, Linux, Mac, iPhone and other mobiles etc.

 

I would like it so that all users to connect up and go and are filtered. With my experience with Websense i used ISA with it but that meant i had to set a proxy address. This is something i dont want, it needs to be setup so it just works without any user intervention.

 

Any Suggestions Please?

 

Thanks

[powdarrmonkey]

If you want it properly, your router needs to deny outgoing connections, and re-direct 80 and 443 (and anything else you want filtered access to, like 21) to your Websense box. On a Linux box this is easy, but I can't help you with a proprietary router.

 

Alternatively, block outgoing connections and use something like DHCP option252 to push your proxy settings out. Anyone who has automatic configuration switched on will get the settings then, but that doesn't mean everyone, so still expect to have to do some manual configuration on this one. [ame=http://en.wikipedia.org/wiki/Wpad]Web Proxy Autodiscovery Protocol - Wikipedia, the free encyclopedia[/ame],

[FN-GM]

If you want it properly, your router needs to deny outgoing connections, and re-direct 80 and 443 (and anything else you want filtered access to, like 21) to your Websense box. On a Linux box this is easy, but I can't help you with a proprietary router.

 

Alternatively, block outgoing connections and use something like DHCP option252 to push your proxy settings out. Anyone who has automatic configuration switched on will get the settings then, but that doesn't mean everyone, so still expect to have to do some manual configuration on this one. Web Proxy Autodiscovery Protocol - Wikipedia, the free encyclopedia,

 

Can you do this with Smoothwall Express?

 

Need to avoid manual config, John suggested the DHCP method on MSN.

[SimpleSi]

I'm thinking if it can be very very hard to stop pupils bypassing a proxy on a locked down AD controlled network, its going to be trivial to bypass any settings on an open one

 

regards

 

Simon

[tom_newton]

FN: I don't *think* you can do blocking outbound on express.

 

Certainly step one is to lock down the net so anyone with "standard" settings gets denied.

You *can* then do transparent filtering which works the same on all browsers but has HTTPS issues.

The WPAD method works "out of the box" for windows machines, not sure on linux - depends on distro/setup, and similarly cant tell you right off the top of my head for iphone etc. but all these can be "manually" set up (stick poster with settings near WAP).

 

The WPAD method can be combined with DHCP and DNS based advertisement for maximum coverage.

 

Give me a call at some point if you want to mull over the whys and wherefores in more detail

[SYNACK]

It only has to be a proxy if you are still using the exceptionally outdated ISA 2000. 2k4 and 2k6 do it transparently just fine. If you are still 'using' 2k talk to your liscencing provider.

[FN-GM]

Thanks for all the comments, may call you tom.

 

I can't lock these machines down.

 

Nope we can use any version. How do i go about using it transparently please?

[tom_newton]

FN: are you using isa/websense as a gateway or as a standalone proxy?

[FN-GM]

FN: are you using isa/websense as a gateway or as a standalone proxy?

 

Nothing has been setup yet

 

Thanks

[tom_newton]

Ah, ok. Well - if you want to go transparent, any filter you use should be set as the gateway.

 

There are other ways (WCCP frexample) but these are not entirely pain free

[FN-GM]

Ah, ok. Well - if you want to go transparent, any filter you use should be set as the gateway.

 

There are other ways (WCCP frexample) but these are not entirely pain free

 

Ok does anyone have a guide on how to do this? How can this fit with the existing Smoothwall Express box?

[tom_newton]

You will definitely have to replace the SW express box - as it can't do the filtering job, and is your gateway at present. Either you replace it with an ISA/Websense or, of course, the arguably classier option SchoolGuardian - which will basically add to your existing infrastructure a transparent filter. Can let you have a play with that if you like?

[SYNACK]

How do i go about using it transparently please?

 

As you have already asked this question and had it answered before I will simply repost the original :

 

Without a proxy server in the configuration it will first hit the default gateway on the highest priority active network adapter and see if it can get the pages directly otherwise if it is set to automatically detect it will look for a proxy.

 

You can setup ISA as a transparent firewall that should run your traffic through filtering but I have not set it up transparently with a proxy. To enable it as a transparent firewall just add a rule that allows HTTP/HTTPs access from the internal network to the external network. You must have it as the default gateway of either the workstations that are trying to connect to it or as the default gateway in your top level router so that any traffic that cannot be serviced locally is sent to the ISA server for routing.

[Innovation_Dan]

AFAIK you would only actually *need* to use ISA server if you're trying to use actual filtering policies on users or groups, and your users are using terminal services. ISA is used to pass authentication information from the TS to the Websense agents. If you're not using TS, then you shouldn't need ISA at all, and in fact ISA just complicates the whole thing tenfold.

 

As for transparent filtering, it depends on how deep you're asking. If you're just asking in general, then there's plenty of responses here already. If you're asking "How do I configure websense for transparent filtering?" then that's a different matter.

 

Websense first has to be set up in your network infrastructure as a mandatory sort of gateway. It can obviously only filter traffic that goes through it. Configuration is going to vary by hardware, but if you're using Cisco routers they can be configured for filtering directly to Websense.

 

Within websense, you'll use various agent services to authenticate users, either the Network Agent or the Logon Agent if I remember correctly. These work to pass authentication info to Websense, and it should be transparent if you're on a domain setup and have set Websense to talk to your LDAP server.

 

If you don't want to actually filter based on specific policies or groups, then you can set up the default filtering service to just apply to everyone. You can tell Websense to use the default policy if it can't authenticate the individual user or computer.

 

As for Proxies and HTTPS filtering, that's a lot harder to set up. You basically need a switch that can mirror a port, and you have to set up a 2nd nic on the Websense server to watch the HTTPS traffic.

 

Notes:

 

1. I despise Websense. It's a house of cards to get running and keep up. Admittedly when it runs it's really powerful and hard to get around, but it seems like if you so much as look at the SQL server or ODBC connections you'll break the whole thing. It takes like 7 different services that are all interdependent.

 

2. I've only really worked with Websense Enterprise, to YMMV.

[FN-GM]

AFAIK you would only actually *need* to use ISA server if you're trying to use actual filtering policies on users or groups, and your users are using terminal services. ISA is used to pass authentication information from the TS to the Websense agents. If you're not using TS, then you shouldn't need ISA at all, and in fact ISA just complicates the whole thing tenfold.

 

As for transparent filtering, it depends on how deep you're asking. If you're just asking in general, then there's plenty of responses here already. If you're asking "How do I configure websense for transparent filtering?" then that's a different matter.

 

Websense first has to be set up in your network infrastructure as a mandatory sort of gateway. It can obviously only filter traffic that goes through it. Configuration is going to vary by hardware, but if you're using Cisco routers they can be configured for filtering directly to Websense.

 

Within websense, you'll use various agent services to authenticate users, either the Network Agent or the Logon Agent if I remember correctly. These work to pass authentication info to Websense, and it should be transparent if you're on a domain setup and have set Websense to talk to your LDAP server.

 

If you don't want to actually filter based on specific policies or groups, then you can set up the default filtering service to just apply to everyone. You can tell Websense to use the default policy if it can't authenticate the individual user or computer.

 

As for Proxies and HTTPS filtering, that's a lot harder to set up. You basically need a switch that can mirror a port, and you have to set up a 2nd nic on the Websense server to watch the HTTPS traffic.

 

Notes:

 

1. I despise Websense. It's a house of cards to get running and keep up. Admittedly when it runs it's really powerful and hard to get around, but it seems like if you so much as look at the SQL server or ODBC connections you'll break the whole thing. It takes like 7 different services that are all interdependent.

 

2. I've only really worked with Websense Enterprise, to YMMV.

 

In this setup there are no Cisco routers at all. All i need is a blanket filtering on the whole network. Can i just install websense on a server and point the clients to use it as the default gateway and it will work?

 

You will definitely have to replace the SW express box - as it can't do the filtering job, and is your gateway at present. Either you replace it with an ISA/Websense or, of course, the arguably classier option SchoolGuardian - which will basically add to your existing infrastructure a transparent filter. Can let you have a play with that if you like?

 

ah but that would cost wouldn't it?

 

As you have already asked this question and had it answered before I will simply repost the original :

 

Sorry i didn't see it. I tried that at my old place who use ISA 2004 and it let internet traffic go through the server but didn't filter it.

[Innovation_Dan]

In this setup there are no Cisco routers at all. All i need is a blanket filtering on the whole network. Can i just install websense on a server and point the clients to use it as the default gateway and it will work?

 

Yes, websense simply applies a default policy to all users and computers unless otherwise configured. You do need to have something passing the info to the server. Default gateway is probably fine for that. If they know how to get around a DHCP default gateway then you're probably going to need more complex protection anyhow.

[FN-GM]

Yes, websense simply applies a default policy to all users and computers unless otherwise configured. You do need to have something passing the info to the server. Default gateway is probably fine for that. If they know how to get around a DHCP default gateway then you're probably going to need more complex protection anyhow.

 

Use the firewall to only allow connections form the websense box will fix them getting round the DHCP.

[SYNACK]

Sorry i didn't see it. I tried that at my old place who use ISA 2004 and it let internet traffic go through the server but didn't filter it.

 

To work like this it needs to be installed as a filter that applies to http traffic. I know that surfcontrol does this so I was sure that Websence would as they purchased surfcontrol ages ago. You may just need to make sure that the correct filter driver is installed. The filter connection can get messed up in ISA (at least in surfcontrol) though.

 

It looks like you are after Websence content gateway from a quick look at their site which does offer transparent filtering

 

http://kb.websense.com/al/12/1/article.asp?aid=3123&bt=4

http://kb.websense.com/al/12/1/article.asp?aid=2536&tab=faq&bt=4&r=0.1411859

[ChrisCole]

Hi,

 

Depends on your budget, but the Cisco ASA security devices support mandatory transparent HTTP/S filtering through a Websense server. The Juniper Netscreen range certainly do too, though not sure about the newer SSG stuff.

 

ASA Specs: http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/prod_brochure0900aecd80285492.pdf

 

The 5505 handles 4000 connections/sec and is about £400. You get a two user license for the SSL gateway with that too, which might be useful.

 

The DC agent/Logon agent running on Websense will handle user identification.

 

Feel free to give us a shout if you have any Q's about setting up Websense (and/or the ASA side of things). FWIW, I've found Websense v7 to be considerably more reliable than 6.x

 

 

Chris.

[FN-GM]

Cheers i have setup websense plenty of times on ISA just looking for other options.

[FN-GM]

Yes, websense simply applies a default policy to all users and computers unless otherwise configured. You do need to have something passing the info to the server. Default gateway is probably fine for that. If they know how to get around a DHCP default gateway then you're probably going to need more complex protection anyhow.

 

Hi,

 

When i do this i get no webtraffic going though at all. Do you have any suggestions please?

[Innovation_Dan]

Hi,

 

When i do this i get no webtraffic going though at all. Do you have any suggestions please?

 

Actually, now that I think about it I don't know that using DG to point at the websense server would work unless you did some kind of routing along side it. In the Cisco PIX setups we use at our sites, the PIX actually knows to pass the info to Websense and then get a response.

[FN-GM]

Hi,

 

I have finally got round to looking into this more.

 

I have setup an ISA 2006 Server. I have given it 2 NIC's. One internal and the other connects to the external network. I have set the client Default Gateway to the server. The firewall rules work well, i can block URLS using ISA.

 

However Websense doesn't the only way i can get it to work is by inputting the proxy server in the Web Browser.

 

Does anyone have any suggestions. I am considering pushing a .pac file using DHCP put i would like to see if i can do it without this first.

 

Thanks.

[tom_newton]

If you can push a pac file, do so. Transparent proxying is generally not worth the hassle unless there is no other way round it.

[FN-GM]

I was hoping to do it without that, but it looks like i might have to.