UTM Transparent Proxy Probleme mit Firefox

Question

Hallo zusammen, 
 
 es gibt immer wieder Probleme mit der UTM beim Surfen im Internet. 
 Die UTM SG330 Version 9.601-5 ist folgenderma&szlig;en konfiguriert: 
 Web Protection>Webfilter: Betriebsmodus "Transparenzmodus", Standardauthentizifierung: "Active Directory SSO", Zugriff bei fehlgeschlagener Authentifizierung blockieren: JA 
 Ich habe mir folgende zwei Knowledge Base Artikel durchgelesen: 
 https://community.sophos.com/kb/en-us/120791 
 https://community.sophos.com/kb/en-us/120348 
 
 Ich habe die Anbindung von den AD Servern inkl. Bind DN und Base DN &uuml;berpr&uuml;ft, passt alles. 
 
 Im Internet Explorer 11 habe ich als "Lokale Sites" http://unsereutm.firma.local eingetragen. 
 
 Im Firefox ist NTLM eingeschaltet und bei den NTLM-trusted-uris eingetragen: unsereutm.firma.local (oder br&auml;uchte man hier auch http:// zwingend?) 
 
 Das Ph&auml;nomen ist, dass die Credentials nur mit dem Internet Explorer an die UTM gesendet werden, zudem kommt es mir so vor, als ob es auch nur beim surfen auf www.google.de ginge. 
 
 Nach einigerzeit (ca. 1-2 Woche), mal mehr mal weniger, k&ouml;nnen die User nicht mehr Surfen. Im Log-File sehe ich, dass kein Username mitgeschickt wird im Firefox und somit die Seiten "blocked" werden. 
 Obwohl beim Firefox NTLM aktiviert ist, hilft das surfen auf www.google.de nichts. Es muss explizit mit dem Internet Explorer gemacht werden. 
 Dann sieht man auch kurz oben in der leiste, dass er "http://unsereutm.firma.local" ansurft. 
 
 Dann geht es wieder f&uuml;r eine Weile.. 
 
 Fragen: 
 
 Warum geht das nicht mit dem Firefox, dass er die Credentials an die UTM sendet? Im Knowledgebase steht ja wenn man es so konfiguriert, dass es gehen sollte.. 
 In dem oben aufgef&uuml;hrten Knowledge Base Artikel steht, dass Transparenter Proxy nur mit http Anfragen geht? Ist das wirklich so? Speichert die UTM dann die Credentials zwischen, weil man kann anschlie&szlig;en doch auf https://www.test.de z.B gehen. 
 Was stimmt an meiner Konfiguration nicht?

In den Browsern ist kein Proxy eingetragen. 
 
 Gru&szlig;

DouglasFoster · Answer

In my experience, Firefox works with AD SSO. 
 Firefox has its own certificate store, so you have to manually configure the UTM root certificate into each user's certificate store, which is very difficult. If this is not done, UTM's Block and Warn pages will trigger a browser warning about a certificate error. PolicyPak.com has tools to do this if you buy their product and deploy their product to each PC. In my opinion, Mozilla's products (Firefox, Thunderbird, and Lightning) have no place outside the home environment, because this is one of several features that are very difficult to configure to organization standards. 
 The problem you are experiencing occurs because Decrypt-and-scan (https inspection) is off. It has nothing to do with the choice between Transaparent or Standard proxy mode. When a request is made in HTTPS, only the FQDN host name is unencrypted. The NTLM information, URL path, and URL querystring are all hidden in the encrypted portion of the packet. UTM cannot filter what it cannot see. 
 As your last post indicates, UTM uses a reasonable workaround: When an HTTP request comes through, UTM remembers the IP address and username. When a subsequent HTTPS request arrives from that address, it assumes that the same user is logged in. (There is probably a timeout factor as well, I cannot speak to those details.) This assumption is safe for single-user machines, but it can produce unwanted results on terminal server machines unless you use the advanced feature to assign each user a personal IP address. 
 Given all of the above: 
 
 If the first request to arrive is HTTP, the whole session will work. 
 If the first request to arrive is HTTPS, the request is unauthenticated and you have told UTM to block unauthenticated requests. Because all of the better websites are now based on HTTPS, the HTTP-first assumption is not reliable. Research studies indicate that HTTPS is slightly more than half of all web traffic, but my experience with typical business usage is that at least 75% of all traffic uses HTTPS. 
 
 Your options: 
 
 Switch to HTTPS inspection. Then every packet can be authenticated. 
 Create a "safe" web filtering policy and filtering action, and apply it to unauthenticated users instead of blocking them. 
 Make http://www.google.com one of your startup pages, so that an http page is launched automatically. Google will redirect to HTTPS, but UTM will be happy because it will have seen the HTTP packet first. 
 Teach your users the need to use an HTTP web address first. 
 
 My recommendations: 
 
 Use Standard Mode and Transparent Mode proxies together. I have a lot of non-browser web traffic originating from fat-client applications and operating system components, and I expect you do as well. The browsers will honor Standard Mode proxy and will pass NTLM information. Fat-client applications and operating system components cannot provide NTLM information and will generally not honor Standard Mode proxy. Using both proxies allows you to use different strategies for the different contexts. 
 My Standard Mode proxy captures web traffic with AD SSO authentication, but it still allows unauthenticated access to avoid your problems. This configuration permits web access for special situations like PCs logged in with a local account instead of a domain account. 
 My transparent mode proxy uses Authentication None, because I want my automatic update programs and fat-client applications to flow through UTM successfully. It also ensures that I have protection from anything that tries to bypass the Standard proxy. 
 I have UDP 443 blocked with a firewall rule. If you do not have this rule, Chrome will bypass your web proxy using it's QUIC protocol. 
 
 I do not use HTTPS inspection at this time, although I have in the past. I worry that my HTTPS traffic flows without content inspection, but there a lot of complications to having inspection enabled. It requires a significant level of expertise and a significant commitment of time to detect and correct the problems.