Hello
I need help, I can't get it.
I want to block the entire internet, except the Google Map page, to a single user.
I enabled STAS but I couldn't assign a rule to the user.
Thank you.
This thread was automatically locked due to age.
Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.
Hello
I need help, I can't get it.
I want to block the entire internet, except the Google Map page, to a single user.
I enabled STAS but I couldn't assign a rule to the user.
Thank you.
Hello Yosi,
what do you mean by "you enabled STAS" ?
Did you configure one of your servers as a "collector" for it?
ave a look here: https://doc.sophos.com/nsg/sophos-firewall/19.5/help/en-us/webhelp/onlinehelp/AdministratorHelp/Authentication/STAS/index.html
Are you running a Windows ADS?
Maybe it is far more easy to add your DCs to the authentication servers and then use the ADS-account to select for the user-specific rule.
Mit freundlichem Gruß, best regards from Germany,
Philipp Rusch
New Vision GmbH, Germany
Sophos Silver-Partner
If a post solves your question please use the 'Verify Answer' button.
First:
Thanks for answering.
I have set STAS to DC.
I see users in SOPHOS, but I cannot generate a rule for a certain user.
Mit freundlichem Gruß, best regards from Germany,
Philipp Rusch
New Vision GmbH, Germany
Sophos Silver-Partner
If a post solves your question please use the 'Verify Answer' button.
Hi Yosi,
If you have created a firewall rule, can you share the configuration you created with us?
You can also try these steps to configure whitelisting:
1. Create a category for the Google Maps: go to PROTECT>Web>Categories> then click Add
2. Create the policy: go to PROTECT>Web>Policies> then click Add Policy
Ensure this is only applied to the specific STAS user, then add the Google Maps category configured in step 1. The action should be allowed and the status should be ON
3. Create a DNS rule (this is to ensure that the domain will be resolved first before applying the policy)
4. Create the whitelisting firewall rule (ensure that this rule is below the DNS rule; ensure the destination network is *.google.com)
Hope this helps.
THANKS
Not work for me.
I make copy but not work, the user can arrieved to all web site.
Make sure that this rule is at the very top since your user can still catch a different firewall rule.
You can also use the log viewer policy checker to check if it will catch the firewall rule
There’s something wrong with your configuration since you mentioned that the STAS user can access the internet, then a firewall rule should appear in the policy test. You can check section 7-b of the kb-article: Sophos Firewall: Best practice for STAS - Recommended Reads - Sophos Firewall - Sophos Community which indicated a firewall rule for STAS users.
For the policy test that you did, I suspect that you indicated the wrong Source IP, which isn’t a part of your network that caused the "No matched rule".
To further investigate the issue, I would recommend that you contact our support so that we can further check the behavior.
Hello
If it's true, I was wrong with the IP.
![](/resized-image/__size/1280x960/__key/communityserver-discussions-components-files/126/2234.RULE_2D00_GOOGLE_2D00_MAPS.jpg)
I thank you in advance for your time.
![](/resized-image/__size/1136x726/__key/communityserver-discussions-components-files/126/WEB_2D00_CATEGORY.jpg)
![](/resized-image/__size/1080x960/__key/communityserver-discussions-components-files/126/WEB_2D00_POLICIES.jpg)
![](/resized-image/__size/1280x960/__key/communityserver-discussions-components-files/126/RULES-POSITION.jpg)
![](/resized-image/__size/1280x960/__key/communityserver-discussions-components-files/126/5556.DNS.jpg)
![](/resized-image/__size/1280x960/__key/communityserver-discussions-components-files/126/7002.WEB_2D00_POLICIES.jpg)
STAS WORK