ibpalle

For iOS devices I think there's an extra step when installing the CA - it needs to be set as trusted, not just installed.

The root CA is the correct one - that can validate certificate created by the secondary https ca used for inspection. You can set the smothwall to use the root ca for inspection instead of the secondary CA as well if you like that better

Web traffic is handled by the proxy and non web traffic is handled by the firewall. It sounds like the firewall policies are blocking outgoing traffic that is not web traffic. Have a look at the reports - realtime - firewall while trying to get to the internet from the non working range and see if there are any blocks.

We actually have a Spotify category now in multimedia. Always a good idea to check if we have a category for widely used apps and services.

Yeah, been present for a while now. Make sure to add safeguarding contacts in the cloud portal to receive notifications for cloud clients.

The load warning is triggered by a parameter set in the report - alerts - alerts settings. If that parameter is still at default, that will cause too many alerts to be sent. The value needs to be adjusted to a sensible value for your appliance. Set it to 8.

A couple of log entries from the web filter might be useful. Also, run the functionality test for basic connectivity in system - diagnostics - functionality tests. Any obvious issues there? Is there a difference between web traffic and non-web traffic? I am assuming you have an AD and clients are using your AD DNS servers? What are the AD servers using - root hints or forwarders in DNS? If forwarders, then which ones?

Latest was pushed to cloud as well. Clients will update normally so should be in effect on a live system within 20 minutes.

Yes - no specifics were given on what.

Latest from the blocklist team: Corrected blocklist is now live. Please let customers know that the issue should have been resolved and provide them with instructions to download the latest blocklist (system > maintenance > licenses). ----------------------------------- Also clear cache on browsers you are testing with

Short answer is yes. The carrier of a VLAN can't have an IP. You need to remove the IP, then add it again as a default vlan and then add your new vlan to it as well. You can do this on another interface and then, when ready, swap carrier interface.

EDIT - changed as I saw the screenshot after posting: Some URL pattern is triggering the advert category. Adding that to the info. Original post: Could well be https related - some brand new or expired certs on advert servers could cause this. HTTPS do not inspect or a do not filter policy will bypass that issue. If the issue is expired certs, then we can only wait until they get updated. If it's brand new ones from a new CA, it could help to download that CA from the local cert store and install it on the Smoothwall in system - certificates - certificate authorities.

Asking the blocklist team to look into it.

It will recognise the existing install but if you are using the 'LogonExclusions' option, you may need to re-add that: https://kb.smoothwall.com/hc/en-us/articles/360007256160 I can't see from the fixes if that was addressed. The relevant bit is the second last paragraph.

Hi Could the category 'GamingAllowed' be included in the list of auth exceptions in web proxy - authentication - exceptions? Also, is the proxy set use any authentication method or is it set to no authentication?

Just a note on the code column and the 200 result that has been discussed. The code column shows the code from the upstream web server. A 200 means success OK so the transaction succeeded. Other examples are 404, 503 etc. Hover over the code to see status result and do a lookup for http server result codes if you would like to know more. This is why you can see both code 200 and code 0 for blocks, depending on block reason. A block for playboy.com will show with a code of 0 as it was blocked immediately due to playboy being listed specifically in both Porn and adult. A search for 'AR 15' could show a 200 for the code in case the block was caused by content filtering. The content of the page caused the block and the filter has to get the content first in order to decide on the block, hence the 200 in the code column. When you see a red block with 200 and no policy listed as the cause of the block, the issue is always related to HTTPS - note that the entries are all for https links. You won't see http. It could be that the client does not have the Smoothwall CA installed. It could be caused by an application using certificate pinning or an app/software that isn't using certificates 'correctly' - apps/software only need to talk to one server, not all web servers in the world like browsers, so they sometimes just embed certificate keys in the app and as long as they compare favourably to the server certs, that's security enough for the app/software. If an app/software is generating red https blocks, then add the target domain to a do not filter policy (or do not inspect in https inspection) - that will get rid of standard certificate checks in the filter and likely allow the app to work.

In this new version there's a fix for base64 URI encoding, nested groups, increased poll rate on monitorSendADData (This greatly lessens the risk of not doing daily/weekly tasks.) and a weekly full-sync to on-prem. Now live on https://software.smoothwall.com

If you are testing by pinging the firewall internal IP on A from B then you may get misleading results. Not a Unifi user but generally you would setup a policy to deny source IP range A access to Destination IP range B. This can be added on either side really. You may need to pay attention to the interfaces too - if traffic is passing over VPN, the VPN interface may need to be set specifically in some of these policies.

Yeah, /31 is a problem for us as we expect a 'proper' subnet with broadcast and network address. Just a thought but haven't tested it. Potentially, if you add the IP and gateway with a /30 and then manually add a static ARP mapping for the gateway device IP, it could work. The issue is that /31 breaks the broadcast and MAC address finding routines so a static MAC address mapping for the gateway IP might work.

I expect the differentiation will mainly be done based on the domain that hosts the material. AI material hosted on domains included in the 'Education and reference' or 'Academic institutions' categories are allowed as those categories normally allowed in our initial template and would host materiel designed for education, for example.

Just a few pointers. Secret knock is widely used and can work across sites. If a DNS alias is created on each site using the hostname of 'secretknock' for example, pointing to the local Smoothwall, the cloud config can be set to use that hostname for the secretknock, making it work at all sites with that configuration. Similar to wpad for automatic proxy discovery really. Double filtering isn't so much an issue as long as the Smoothwall CA is installed on the client. Can make troubleshooting a bit trickier but mostly just an additional bother, not a showstopper.

Talk to your account manager and get a session arranged for adding an extra connection and a health check. We are quite busy at the moment so lead time is high currently but it's certainly something you can ask for.

The authentication exceptions category are only auth exceptions if they have actually been placed in the web proxy - authentication - exceptions section. Otherwise it's just a normal category. You can still have HTTPS bypass and a generic allow for facebook for staff users and a block for everyone else but obviously users need to be identified. By the way, Facebook and other social networks work fine in the browser with https inspection - it's the apps that are having issues - a compromise, if you need to monitor the social network traffic is to use a browser for access, not the apps.

Then it's unlikely to be related the the Smoothwall CA I'd say. Take a look at the certificate and authority on a page that is showing the error.

With the cloud filter, the certificate authority is not needed - recommended but not needed - if the secret knock has been setup and is working (check in Guardian » Client interfaces » Cloud Filter )