ibpalle

Hi all A new addition to the Smoothwall webpage summarising the services options Smoothwall offer to assist with remote learning/working etc.

Have a look at the SSL VPN setup primer I have just posted in the Smoothwall support forum.

Or setup a custom linux box, no need for direct internet, just setup the VPN and use it as the gateway for the remote network. For IPSEC just forward UDP ports 500 and 4500 to the internal VPN router on both sides.

Hi Davie The setup can be a bit arduous - we have recently updated the KB associated with this to point at Google KBs instead of trying to keep up with updating our own to match the frequent changes in the Google admin interface. I am assuming you are getting the error from the authentication system when trying to diagnose the google connection? Customer ID is likely due to the ID of the service account being incorrect - I have done this myself a few times where I used the wrong ID. A while back I wrote a step-by-step for a customer. I have added it here but some of the instructions with regards to Google admin console are no longer as precise. Step 11 in the first section is the one I think may be going wrong. Also, here are 2 links to our KBs which should help as well. https://kb.smoothwall.com/hc/en-us/articles/360004030519-Authorizing-the-Google-Service-Account https://kb.smoothwall.com/hc/en-us/articles/360002031770-Creating-the-Client-ID-and-Client-Secret-for-Google-Authentication Create a Google Service Account 1. Go to https://console.developers.google.com and log in as an admin user. 2. If it is the first time you log in you will be prompted to accept the Google terms and conditions. 3. Create a new project in “Apis and services - select project – create”. You cannot reuse an existing project if you have created any previously. Note: If you have previously created projects under the logged in username, you may find the menu options are “project_name > Create a project”, where “project_name” is a previously created project. 4. Enter a suitable Project Name as Smoothwall Login and click Create. The project name appears in the top left when it has been successfully created. 5. Click the menu icon at the top left, and select IAM & Admin, select Service accounts and click CREATE SERVICE ACCOUNT. 6. Enter “Smoothwall login” for the service account and use “Smoothwall directory connection” for the Service account description; then click Create. 7. This will then bring up the Service account permissions screen where you are asked to select Role - Do not select a role, just click Continue. 8. This will then bring up the Grant user access to this service account screen where you again are asked to provide role information; Service account user role - Do not enter any information; Service account admins role - Do not enter any information. 9. Create Key, click Create key and choose JSON key type, then click Create. 10. JSON key is downloaded automatically to your computer, click close on the popup and click Done. 11. Obtain the Unique ID number (previously this was the Client ID) - This is done by enabling the Unique key view in the ... (to the far right of the service account entry) options icon. This number will be required to authorize the service account. 12. Save the Unique ID number and also rename the downloaded json file to be tenant-name-service-account.json. Authorize the service account 1. Go to https://admin.google.com and log in as an admin user. 2. Click Security, then API reference and Show more > Advanced Settings. 3. From the Authentication section, select Manage API client access. 4. In the Authorized API clients > Client Name field, enter the Unique ID number for the Google Service Account created in the step above. 5. Under One or More API Scopes, enter the following (All on one line, no breaks or spaces): https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.orgunit.readonly,https://www.googleapis.com/auth/admin.directory.user.readonly 6. Click Authorize. Add the google directory 1. On the Smoothwall master, navigate to “Services - authentication – directories”. 2. Select “Add new directory” 3. In the Tenant field, select the applicable Tenant. 4. Select Google directory 5. Enter name as "Google tenant name" 6. Upload json file you downloaded from the dev console 7. Add the G-Suite admin username in the authorised user field and click add. Run diagnostics - in case of issues, visit the URL shown and check that API have been enabled. Once any errors have been corrected, sync the Google directory. A Sync button will appear when you hover over the directory entry. The sync will take about 15 minutes.

I think the Unify controller is the one to look at here - if a logoff is sent from the controller, lightspeed or any other radius service would honour that. I have seen a similar case where the user, even though stationary, was swapping between APs causing a general mess with the users auth as the IPs were swapped for a brief second too. Apologies for not being more specific.

That is normally not the case when the license expires - we can manually expire the license in case of issues so the information is correct in that way.

In addition to blocklist not updating, system updates will also not be available.

Always a good idea to test with a limited but representative set of users - HTTPS inspection can interfere with a lot of applications. Browser generally are fine but third party apps using HTTPS often use certificate pinning or simply embed public keys into apps, as they only need to talk to their own server. Generally applications is the main thing to test when moving to HTTPS inspection.

Time is important when dealing with Kerberos - if this single user is always on the same PC, then check there is no time skew - other than that, cant really give you any other pointers.

If they are using same subnets, routing will be an issue - you could apply NAT but in the long run, re addressing one subnet would be better. Less confusing. Once the tunnel is setup, just remember to add an access rule as tdk1069 mentioned. Just allow the IPSEC interface access to the LAN. If you want to be able to access the Smoothwall admin GUI over the tunnel, then also add the IPSEC interface in the Smoothwall access rules. Finally, when setting up the tunnel, remember to expand the advanced section and add the Smoothwall LAN IP in the local IP address field. This allows the Smoothwall itself to use the tunnel for the remote subnet.

I can't give any timeframes or specific info as such. BETT will obviously have some announcements so follow that too. A lot of what's coming are refinements, pulling projects closer together as well as enhancements to all offerings - business processes as well as software.

Lots of alternatives - some even fairly good I'd suggest, with obvious bias, to hold on a bit to see what we have to offer both by way of product options and improvements in support structure. 2020 looks to be very interesting Smoothwall wise.

Smoothwall is offering just that at the moment - extensions for filtering instead of going through a proxy. Only supported for Chromebooks at the moment but other browsers and OS are in the works. It has it's caveats as everything does but the extension providing the filtering means HTTPS decrypt is no longer needed as the extension reads the page content coming out of the browser, not sitting between the browser and the internet as the proxy does. Interesting to see the takeup on that.

Whitelist spotify.com should do it.

The content modifications will for the most part have no effect unless HTTPS inspection is enabled for the content. When a content modification does not work it's mostly either no HTTPS inspection (due to exception policies like whitelist or do not inspect or due to QUIC being used) or that the content that's being modified has changed and we need to update the blocklist to account for that. The policy test tool should be able to tell you what custom or built in categories all or some of the content that is being accessed, belongs to. It could be that some of the domains have crept into a custom allow that is also being used in a do not inspect rule for example. As always, when testing content modifications and https inspection, take extra care to restart browsers or at least close any existing tabs open on the test sites before retesting. Also: Mobile apps - often mobile apps will not work with HTTPS inspection. Domains could have been whitelisted there as well so be sure to make a distinction about the type of client used.

Hi IT_Turn_It_Off_On Nothing has changed with the content mod so it should still work. One thing that could cause it to stop working could be QUIC. The obvious symptom of QUIC use is that HTTPS inspection is not being applied to Google searches. If that's the case, then QUIC is likely the issue. Firefox, Chrome and others support this Google created protocol that can switch to using UDP for web traffic - not a good idea if filtering is needed. In Guardian - Content modification we have a category called Remove QUIC header. Could you check if that is enabled? Also, in addition to enabling the content modification or instead of, you can block outgoing requests to UDP ports 80 and 443 on a firewall level. On a Smoothwall that's done in Network - Firewall policies. If this is not the issue, there could be multiple causes - most likely a google image search domain has been added to an allow or whitelist policy somewhere? Use the quick policy tester in Guardian - quick links to find any policies that may affect a google image search. That should point you in the right direction.

Use the content modification on Smoothwall to enable Basic image search on google. That will revert to the older way of displaying the results, which does not suffer from the opaqueness the source of the thumbnails gets in the newer display mode.

I assume PFSense is the DHCP server on both sites or are you using relay to have one DHCP server for both sites?

I'd have to agree - the filtering options are a bit basic for an educational environment. For switch/APs it's very good but I'd opt for a separate firewall and/or filtering solution.

No, I can't resolve the hostname either. Old version of the software? So if they do not call that co.uk domain, where is that traffic coming from?

Here is another solution Create a custom category containing the domain you want to redirect. Put a block policy in place in the web filter for that category. Go to Guardian - block page - Block Pages and create a new blockpage. Enable the redirect to blockpage option and enter the URL/domain you would like to redirect to. Once saved, create anew blockpage policy where the what is the custom category containing the domain you want to redirect and the blockpage is the newly created redirect to new URL blockpage. Jobs a good one and no faffing about with regular expressions. With the capita.co.uk to capita.com I would be careful as Tom says - why is this needed? When you go to com, it may redirect you back to co.uk since the originating IP is in UK so you may get a loop.

The HTTPS block page answers are correct - when blocking an HTTPS page, filters cannot redirect to an HTTP page and show block information. The HTTPS blockpage is there so users see the actual block information and as such, the blockpage is using a certificate created by the CA on the filter - user devices needs to trust this CA in order for the certificate warnings to disappear. Smoothwall have a cloud filter option on the way - currently out for Chrome and other browsers are close. This is a filtering extension that filters looking at the content coming out of the browser, not filtering the traffic sitting between the browser and the internet. With those browser extensions installing the CA is not needed but obviously won't be applicable to BYOD devices. Installing the CA is easy enough once you get used to it and instructions are available from Smoothwall and other vendors.

The setup sound correct - 2 port forwards on different IPs and they are both working fine. No need to change that I think. The problem could be routing - I am assuming the Kemp load balancer is using the Smoothwall as it's default gateway out of the network - do you have any SNAT rues in place for the IPs "behind" your port forward?

Just had a similar case - the customer found the answer, turns out for YouTube embedded in PowerPoint you need Internet Explorer's Protected Mode to be 'on'.....

Depends on the state of the serial number you are going to use. Out of license serials do not get updates or blocklists. Dead serials will notify and shut down the system. The hardware itself isn't important for license considerations really - only warranty considerations. So if you bought a 2-3 year old UTM and fired it up, without a working license you would be stuck at the update level the software is at - not really the best testing platform. Talk to your account manager - you could likely use an existing one for the UTM as a tester or get a new serial from your account manager for testing purposes. If this is only for testing, consider VMWare or VirtualBox install instead of buying old hardware.