Blocked site get the "Network Authentication" page instead of "Blocked Request" page...

Hi All,

Thanks for choosing Sophos.

To give a denied page when a User tries to access a blocked website, you need to select NO in unauthenticated user redirection. If you select YES, XG will prompt Captive Portal to User(s). This is useful when you have defined web filter policy-user wise. Suppose User A has access to streaming media, alongside User B is denied the access to streaming media category, during such requirement the provided settings are quite useful. But with XG, I discovered that we lack the feature to configure the "User's applied policy" within a Firewall Rule>Policy for User Applications. So the workaround to get this feature work is to create multiple Group based Firewall Rule, where we can define granular filter options for respective groups. Hence, when a User receives a Captive Portal page and authenticates himself on it, XG will check the group association and take action.

Hope this helps:)

Thanks

Hi All,

Thanks for choosing Sophos.

To give a denied page when a User tries to access a blocked website, you need to select NO in unauthenticated user redirection. If you select YES, XG will prompt Captive Portal to User(s). This is useful when you have defined web filter policy-user wise. Suppose User A has access to streaming media, alongside User B is denied the access to streaming media category, during such requirement the provided settings are quite useful. But with XG, I discovered that we lack the feature to configure the "User's applied policy" within a Firewall Rule>Policy for User Applications. So the workaround to get this feature work is to create multiple Group based Firewall Rule, where we can define granular filter options for respective groups. Hence, when a User receives a Captive Portal page and authenticates himself on it, XG will check the group association and take action.

Hope this helps:)

Thanks

But, the problem we are having is with Clientless Users.  I makes no sense to be directed to a login page when no login is possible ( no user accounts exist ).

This is with "Identity: Match rule based on user identity" set to OFF in the policy.  So, if there is no checking for User Identity, why go to login page?

The only workaround found is to add IP addresses (usually your entire LAN address space) to the Clientless Open Group and toggle each one to Active.  For some reason, that doesn't seem to work for everybody.

Another thread about same issue:  https://community.sophos.com/products/xg-firewall/f/124/t/76445

Am I misreading something? [:$]

Hey,

for someone currently using about 50 SG units of almost all sizes, this webfilter setup is just plain weird.

Why not have the block page get you that "unblock url" button with authentication option again like we do have it in the UTM world right now?

For us who are planning on migrating to XG this change in setup is a major problem.

Will this be adressed in a future release?