ibpalle

Same dialogue as the setup for the notifications in reports - safeguarding - notifications. When you look at the edit screen for a notification you will have a dropdown for notifications where the options are: None, Daily, Weekly, Monthly. Then below, you will have an option for 'Also send instant alerts'. These are 2 separate options - you can enable either or both. I normally recommend having a daily notification summary for all categories and then have a additional notifications with instant alerts for specific categories like 'Suicide' and 'Bullying' for example.

The safeguarding notifications have 2 options with regards to content of output - one is the summary report, the one you are getting daily. This can be done weekly or as monthly summary as well, however, the weekly and monthly summary just shows user/IP and the number of incidents in each category, while the daily one shows the URL/Searches that incurred the breach as well. Another is the instant e-mail option, which, as the name implies, is sent out as soon as the incident is recorded. These two are separate functions and can be set to include content from one or all safeguarding categories. Within that framework, you can setup any combination of notifications and instant alerts you need. I hope that helps?

The RADIUS entries you are seeing are coming from the services - authentication - BYOD section. Smoothwall is acting as RADIUS service for your Wifi setup.

Everywhere as location object includes all IPs so that will work. Could the device be using proxy settings - automatic or static? The login information is correct but not relevant to the issue with missing authentication configuration. Try a quick edit of the transparent proxy and save, then restart the proxy service. Sometimes, when IPs have been changed, proxy configuration needs to be manually updated. A resave and restart of the proxy (or a system reboot) will sort that out.

That error is shown when the proxy has no configuration to allow for the source IPs of the client. If you are using locations and define the 'Where' column in your proxy policies, make sure the BYOD subnet is included in your location definitions for the proxy the clients are going through.

In a sense yes. Web traffic has to be routed via the Smoothwall interface with the transparent proxy. All HTTP(S) traffic is then redirected to the proxy using a firewall policy on that interface.

If these are generally devices on the Wifi, make sure that any client separation features, if enabled, exclude the gateway and switch addresses on your network. If the Smoothwall is the gateway and you are using RADIUS for authentication of the clients, there could potentially be another issue in play. Let me know if that's the case.

If there is a service running on the client system that triggers a domain account login for the Anonymous account from that IP and then later, the user accesses a file share or in some other way triggers a domain account login, then the user switches back. Also take note that any authentication exceptions from the proxy - authentication - exception section will still cause access to those destinations to be logged without username. In general, if no active proxy login methods are in use auth exceptions can be removed.

When using the newest iDex agent 2 from https://software.smoothwall.com/ - once installed, you can add an exclusion parameter to the registry for the idea agent to exclude certain usernames. Open regedit and find the iDex agent parameter folder in Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IdexAgent. Add a new string value called 'LogonExclusions'. Add usernames into the string in a comma seperated list: NT AUTHORITY\ANONYMOUS LOGON,DOMAIN\Service_account And restart the iDex agent service. This will need to be done on all agent installs.

The 'Drop connection' blockpage option can be useful with large BYOD numbers. A lot of the categories like 'Computing' and 'Social Networks' etc generate a lot of blocks from devices without the CA installed for example. None of those types of applications are capable of showing a blockpage anyways so applying the drop connection blockpage option to categories that show a large number of blocks on your BYOD network can be a good resource saver. The Smoothwall does not have to generate sometimes millions of blockpages that no-one ever sees. Find the categories causing the most blocks, then go to the Guardian - blockpages - manage policies and add a new policy to use the 'Drop connection' option for the blockpage, applied to the BYOD location and the categories found to generate the most blocks.

With regards to Qustodio, on Android and iOS you would need the dedicated app. I don't think any extensions load on Chrome in those environments.

That does sound weird - the VPN is obviously working but having to use the proxy in order to access the device on network B is odd. Is the port number used when using http(s) non-standard?

Says certificate is valid until the 2nd. Could mean that once 2nd Sept comes round it's invalid. Since the message says date is invalid, that could be the case.

For client VPN, our OpenVPN client could be run at startup with saved credentials but there is no specific always on functionality in the client as such.

If the kerberos login script is running on clients, those will overwrite the iDex logins. The script refreshes every 2 minutes. Try looking at the reports - realtime - system and select authentication in the section drop down list. Do you see any iDex activity there? Everything in the diag looks fine.

What are the numbers shown in the diagnostics for the idex directory - hover over it in services - authentication - directories and the diag button should pop up. If you try a domain login on a normal PC/Laptop, any results?

The event viewer - windows - applications - will show entries from the iDex agent. It may show what's going on. You can try to clear iDex info in the services - authentication - settings as well. If you do that, run the program files\smoothwall\idexagent\sendaddatanow.exe on one DC with the installed iDex agent to update the iDex directory on the SMoothwall with the AD groups again.

How did you test the URL in Smoothwall ? Using the policy tester? Any different results when you try different browsers? The allow access to servers on these additional ports is only valid for https traffic when using proxy settings. It has no effect on transparent proxying or http traffic.

Interesting workaround. I assume HTTPS inspection is off for classroom and/or youtube traffic?

Forgot to add - when troubleshooting, the reports - realtime - system logs can be handy - select SSL VPN in the section dropdown.

UDP port 1194 or tcp port 443, depending on what you select on the global options. Also, you will need to fill in the 'SSL VPN client gateway(s):' field with the external IP you have been allocated on the local authority's firewall.

Setup an AD connection if you are using AD, if not, setup local users in the directories section. Add a firewall rule to allow traffic from the SSL VPN interface into the LAN Go to the VPN section in networking and create a CA and a certificate in the 2 certificate sections. Go to the global page in VPN and set the certificate you created as the one to use. Then scroll down to the SSL VPN section. Select a subnet that is suitable for your network - this is the subnet users will get their IP address on when they connect. Use UDP 1194 for the protocol since users are connecting from home mainly. Use the button at the bottom to export the Windows client and the ovpn file. Install the client and use the import ovpn to create a connection. The ovpn file can be used by other OS clients.

Yes, should not take 30 mins but to be safe

The policy column only shows content if a policy has been matched. For anything that has not been specifically blocked or allowed the policy column will be blank. Have you setup a Google directory connection and mapped OUs or groups in services - authentication - directories?

I am on an Android 12 device but was able to install the CA as CRT file from the settings with no issues. Not certain why your dialogue disappears - you said you had downloaded to USB storage - have you tried copying them off the USB storage and placed them on internal storage?