ibpalle

Looks like there's no controller for the install. Contact support and let them know what Smoothwall serial (Not UNC) the cloud filter should get it's config from. Once that is set, this error should go away.

In case you DO have a transparent policy in place and the Smoothwall is the firewall as well as the filter, please change the setting I described. Any applications not using proxy settings will be going through transparently - in addition, you could add Apple IP range to not be intercepted by the transparent proxy - you can add the IP range of 17.0.0.0/8 to the destination exceptions in guardian - web filter - exceptions.

PM me the ticket number, I'll close it. Thanks for the suggestion - you could always reply to the ticket stating the issue has been resolved. At least the agent won't have to reply then.

Any network interface IP with a gateway added will perform a connectivity test - it's basically a DNS lookup on Google DNS servers. If that test gets no reply, then Smoothwall assumes the connection is down. You can disable this check in the IP address setting for the interface. If you have only one external connection, Smoothwall will not turn the connection off. If you have more than 1, then a fail connectivity test will cause the Smoothwall to stop using that connection.

I am assuming you are using transparent proxy - please make sure the HTTPS method drop down for the transparent proxy use the option to allow transparent incompatible and filter others by certificate. Additionally we do have an app category now in the blocklist - might be an idea to try to allow those. They are in IT and technical.

Yes they are using Supermicro motherboards. We also have this KB by the way: https://kb.smoothwall.com/hc/en-us/articles/360002033090

Here is the info we have IPMI creds https://www.supermicro.com/en/support/BMC_Unique_Password ***Configuring IPMI on Smoothwall*** Applies to S14 appliances If it is a blue box S14, the username and password (which are needed further below) are found within the front faceure plate on the front of the Smoothwall. This will need to be unscrewed to view the credentials. Boot the S14 appliance up, and hit the "DEL" key to enter the BIOS, once the BIOS has loaded, navigate across to IPMI & Enable BMC network config. Confiure IP addressing as STATIC and enter the LAN IP of the Smoothwall (or a LAN IP of an interface that will be accessed for IPMI access). Enter the subnet and gateway for this interface (smoothwalls gateway) and then reboot the box. At this point, (provided an ethernet cable is configured in the IPMI port (Dell call it: iDRAC and HP: iLO) and into the relevant switch on the LAN) you should be able to ping and then directly access the LAN IP of the Smoothwall via a web browser. Then you should be prompted for credentials in the web browser to log into the IPMI settings dashboard. ***if configured in HA, these IPMI settings won't replicate so make sure to configure on each appliance*** the idea of IPMI is that it connects to completley different hardware, so if the main LAN switch goes pop you'd still be able to connect to the Smoothwall via the IPMI port So for example IPMI port configured 172.16.0.20 LAN port is 192.168.50.1 tab or f11 if supermicro to get to bios_grub https://en.wikipedia.org/wiki/Intelligent_Platform_Management_Interface

As the Google Meet won't work with HTTPS inspection it's a bit of a problem. It is possible to block google meet completely at specific times which might be useful but if it needs to be available and being misused during that time the filter can't see the content. The cloud filter extension, if you are using Chromebooks might have better luck as HTTPS inspection is not needed when using the cloud filter extension.

The sync error seems to be due to lack of permissions, as seen in the first thumbnail you posted. In this KB https://kb.smoothwall.com/hc/en-us/articles/360004033739 could you check the 2nd part of this section '1 - Configure & Authorize Service Account.'

There is a Google Meet category as well now in IT and technical. Add that to HTTPS inspection exceptions.

Add classroom.google.com to a do not inspect policy in Guardian - https inspection - manage policies. That should be the only thing getting in the way.

The addition of 'Filter others by certificate' allows HTTPS using a certificate that can be validated to pass into the proxy even though SNI info is not present or ID info is not correct. The option is meant to match any HTTPS traffic which isn't in our transparent compatible sites due to range of IPs being too wide or other reasons, basically relying on the fact that if the certificate used is valid, we will let it use the proxy. This does not allow it through Guardian by default - the Guardian filtering still applies after this check has been done. So yes, you should use this option - it can be the only method as valid HTTPS traffic will use a certificate that can be validated, even for most of the software that use I target IPs that ware in the transparent incompatible sites.

Could you set it to 'allow Transparent HTTPS compatible sites and filter others by certificate' and see if that makes a difference?

What is the HTTPS method set for the transparent proxy? Edit the auth config for the transparent proxy - it should not be set to 'Block HTTPS traffic with no SNI header'

Hi _techie_ Is this with using proxy settings on the client or relying on transparent proxy? If transparent, could you edit the transparent proxy policy and tell what the HTTPS method is set to in the drop down list?

The Network » Settings » Advanced area has a setting for increasing the conntracking size in case you want to try that.

Do you have more than one interface with a gateway set and if you do, are both internet connections?

The Safeguarding activation is not done based solely on the web filter categorisation. In this case, either the search or the search results both had categorisation as personal weapons but only one triggered the criminal activity safeguarding category. There was a thread about this a few weeks back: http://www.edugeek.net/forums/internet-related-filtering-firewall/217528-smoothwall-safeguarding-reports.html

Blocks happen both due to search text and search results. HTTPS inspection needs to be active for this to work. If the safesearch via connect header content modification is enabled, safesearch results will be presented regardless of https inspection. Sometimes simple searches do not provide enough context in the search text alone to trigger a block but the search results do trigger a block.

There are options - they are manu8la but they are there. A redirect to the login page is available on the global proxy - unfortunately the transparent auth methods NTLM and Kerberos will not work. Proxy auth may be an option but not really secure.

Just a question - if the global proxy is in use for the iPads it normally requires users to authenticate. If that is being done you should get usernames with your activity reports so just wondering.

There is work going on on that front - some much needed updates and tweaks are in the pipeline. Personally I think the aim is still to be a good enough firewall option for most customers. Filtering and Safeguarding has been the main focus for many years as we have tested and refined our products and approach. There has been little immediate need for firewall additions or changes. Due to that, some areas are beginning to show their age and there are now projects begun and lined up to address a lot of this.

And that does not require the hostname to be the same for internal and external proxy.

I believe there is a proxy directive that sets proxy based on client subnet. If it's internal, use one proxy, if not, use the other. That should be something like: // If the IP address of the local machine is within a defined // subnet, send to a specific proxy. if (isInNet(myIpAddress(), "10.10.5.0", "255.255.255.0")) return "PROXY 1.2.3.4:8080"; // DEFAULT RULE: All other traffic, use below proxies, in fail-over order. return "PROXY 4.5.6.7:8080; PROXY 7.8.9.10:8080"; https://findproxyforurl.com/example-pac-file/ is a good resource.

jblackburnHWGA The PAC file you use for internal and external can be different but obviously then has to be hosted elsewhere. However, if you resolve the external hostname to the internal IP of the Smoothwall while users are in the network and to the external address when they are outside the network, you can nuse the same PAC file for both internal and external users with no issues. Then add both IPs and hostname to the exceptions.