ibpalle

Looks fine. What you are doing is double NAT. LAN Network is behind a NAT device, which in turn is behind another NAT device before the internet breakout point. Something that can be required depending on the router equipment available.

Interesting - thank you for posting your solution.

Is this using fast user switching? The script should run on login and every 2 mins after that if setup correctly. Internal timeout for the script login is 3 minutes, so if the script only runs once, the logout will be after 3 minutes so it sounds like the loop breaks and the 2nd and consecutive run never happens. Another option now is to try out the iDex agent instead - that should work fine but there are a few caveats so please contact support and get them to assist you. It should not require any changes to the proxy settings. An iDex directory type needs to be added to the Smoothwall and the iDex port needs to be opened in the smoothwall access section but other than that, the system should work just the same. The caveat is that iDex agent logins needs to be set to time out on a daily basis, otherwise they stay constant. This can cause misidentification scenarios in some circumstances - mainly if networks are not segregated between byod and LAN for example or there is a lack of DHCP addresses so IPs gets reused between devices often. Otherwise it's fine.

Glad I could help. Bonds are also simple, unless you are already using the interfaces you plan to put in the bond. Simply go to networking - configuration - interfaces. Create a new interface using the button at the top right of the list. Select bond, name it and add the 2 interfaces you need to be part of the bond. If you are already using one or both of the interfaces and they have an assigned IP, then those will need to be removed before the physical interface can be added to a bond, so you may need to go through some hoops to get that setup. Also, if you will be using this bond as a proxy interface and you are replicating proxy settings to the children, some additional care needs to be taken as the sequencing of the interfaces has to be the same on child and parent in order for the config to translate correctly. If you are using the interfaces currently I would suggest contacting support to get assistance with this.

All the current guides can be found here: https://help.smoothwall.net/Leeds/Content/main/main.htm

Its a simple process - the only pitfall is really just making sure the settings that are replicated are sound., Since you already have a working child I am assuming you are using an existing replication archive. On the parent system, go to system - central management - settings and download the central management keyfile. Again on the master, setup a profile for the child in the system - central management - child node settings. You should be able to just use the same settings you have for the existing child. Just replace IP/Hostname ofc. Lastly on the child, go to system - central management - settings, select child node, upload the central management key. The master needs to access the child on tcp port 222 (ssh admin port) so make sure that port has been opened in network - firewall - smoothwall access on the IP address/interface that the master is connecting to. That should be it - go to the overview page on the master in central management and refresh the entry for the new child. You should start seeing information there.

The policy tester sometimes have issues when used on a multi tenant systyem as well. I thinks it's down to location. Try selecting a location other than everywhere.

Hi Pete The cert error could be on the server side, not the Smoothwall side. Result is the same though. As mentioned in the thread, remove https inspection for the domain and a restart of the proxy with cleared cache may also be needed after that as well. Ups, forgot to add - No, when HTTPS inspection is turned off, the proxy does not check certs.

The issue with Multi tenant and SSL is that requests are directed to auth via a domain based on the ip address ranges in the multi tenant config. Given that the SSL VPN connections can be coming in from any external IP address which will not, by default, be in the tenant ranges, auth fails. If you only have a number of users coming in from known external IP addresses, then no hotfix should be needed. Just add the external IP to the tenant for that auth directory connection.

Can other users login and what's the result if you test a login on the ssl login page? (https://smoothwall.ip:442/login)

Auth Username/Password verification failed for peer Would seem to be the kicker here. Check that they entred username and password correctly. Does it work for other users?

Hi all A couple of replies: Ecosia.org - you have to use enforce safesearch and https inspection currently. It should be possible with the content header safesearch content mod but this is currently being looked into by our blocklist team. Safesearch setting may be able to be set by the user but should revert once they perform a search if the via content header content mod is enabled (google/bing etc). The enforce safesearch content mod will need HTTPS inspection in order to work. Both can be used simultaniously. Also be aware that the QUICK protocol may cause some weird results if not blocked. Here is a KB about QUICK

If HTTPS inspection is not turned on, then it likely won't be able to enforce the safesearch. I'll ask our blocklist team as well to see if they have some insight.

Hmm, not directly on the GUI but it should be possible to add something like that to a custom pac file and upload that to be served from the Smoothwall. A good resource for pac file writing is linked in this KB article https://kb.smoothwall.com/hc/en-us/articles/360002921479

Not without an expensive addon. Last I looked at this there was a RADIUS extension service to Google from a third party but it was not free by any means....

Wow, good to know. Seems a bit random to leave that hanging around. Glad you found this and thanks for posting it.

Until that is fixed, the location workaround is likely the best option to avoid auth issues. Is the SSID on the same IP address range? If it is, can you change it?

Yes it would. So sounds like the pac info is stored and used even if there is no autodiscover results. That is weird - or wIErd... Does resetting IE fix it? Again, not a fix per se, just for information to make sure it is an IE stored info somewhere.

Obviously. What if you remove autodiscover in the settings - still the same behaviour?

The query for the Smoothwall is likely the pac file proxy hostname it tries to resolve. Where it's getting that from though is the mystery. Is this on all browsers or just IE? If autodiscover is turned off do you see the same behaviour?

Interesting. If the DHCP is not giving out the option then th only way it can be done is via DNS - using the wpad hostname. Automatic discovery works on IE using either DHCP or DNS. On other browsers it's just DNS. I would assume this happens due to wpad being available as a hostname for autodiscovery of proxy. Since that can't be removed if you want other browsers than IE to pick up auto settings, one way of avoiding at least authentication issues for BYOD is define a location for the SSID IP range and set that location to have different auth options in the proxy.

Not if you add it to the domain/url list. That will only check against the tld, from the back. So io will match badserver.baddomain.io and baddomain.io but not io.ioinadomain.net

This could be a load balancer issue - see this thread. http://www.edugeek.net/forums/smoothwall-direct-support/197149-tls-handshake-server-failed.html

Interesting - should only match the final tld using that rule. You could try using the url patterns method listed above instead. Also, try running the policy tester for the url - might get some more info from that result. Is there anything else in the Blocked gTLDs and ccTLDs category apart from domains? Anything in search or url patterns?

I guess it comes down to price and convenience as well as experience. If you are comfortable managing your own firewall, Smoothwall is a perfectly capable tool for it, however the value add and experience RM brings to the table needs to be considered as well.