exa_markd

Hi Alex, we have a solution that can do most of your requirements. Please drop me a PM to further discuss. Kind Regards Mark Dearlove

@fairm010 Please can you contact our Support Department so we can help investigate your issue. Our contact numbers are here - Exa Networks - Business and Education Internet Solutions Kind Regards, Mark Dearlove SurfProtect Team

Chris I think you need to talk to us at Exa directly if you have issues or possibly don't understand how our product works. Please call us free on 0808 123 2323 and we can discuss your issues. Kind Regards Mark Dearlove SurfProtect Team

@chrisakak9, at Exa we endeavour to fulfil our customer's needs with this in mind I would like to understand more about the challenges you are facing in relation to content filtering. We have a category that can block what we deem "Uncategorised websites or websites where it is less obvious what the exact category should be." We also provide the means to let Exa know when things need global classification change if we have it wrong and customers all gain the corrected category. It is also possible to reclassify websites at the customer level to override the global classification if necessary. It sounds like you are using our entry level SurfProtect Cloud product - maybe with SurfProtect Proxy to protect HTTPS traffic? Which is also included at no extra charge to your connection If you require AD integration, Single Sign-on, full HTTPS filtering then you would be best using our SurfProtect Fusion product which requires a ICAP/UTM device that we can provide, configure and maintain for you. You would not need the 2 LAN approach with the ICAP UTM if you wanted to merge the LANs. Filtering would also be based on AD users, user groups or internal IP. I work on the SurfProtect Product Team as an Engineer, please can you PM me and we can help resolve your challenges with the filtering.

This may help @ithappy - http://docs-legacy.fortinet.com/fweb/admin_hlp/4-4-5/index.html#page/FortiWeb_Help/topology_for_reverse_proxy_mode.html

I cannot remember what the SSO agent does for switching users - I guess as long as it generates logout events there firewall will get to know. The Captive portal can be made to generally expire a login after a period of configurable time or the user can logout of the captive portal to free up that machine ip. Captive portal is good sometimes to temporarily 'elevate' permissions from default - say student to staff permissions for web. Based on what I have seen of various UTM suppliers.

It surprises me that an agent is needed on the workstation David, I have come across some UTM's that monitor the event log activity of the Domain controllers to track logins. This activity is then passed onto the UTM so that when web requests are made the appropriate filtering can be applied. This also achieves SSO with a captive portal for non windows hosts.

Yep Exa also support the nosslsearch DNS fix as we have a custom DNS service for SurfProtected customers.. Cheers Mark