SSL VPN UTM 9

Question

Hi Guys, 
 
 Recently we've set up the SSL VPN Connection in our office. We just want to ask something cause right now we are completely puzzled out by configuring the Sophos UTM9 for SSL VPN. We configured it successfully and was able to install the SSL VPN through the User Portal, but we want to know is, is it possible to to implement the Web Filtering inside the SSL VPN? cause we want some users to access the SSL VPN at home at the same time they can use the network in our office when they are connected to the VPN. Please see screen shot below to help us.

Please help us understand and help us 
 
 Thanks 
 
 -JSigz

apijnappels · Answer

In the VPN profile you need to add 'Internet IPv4' (or any) otherwise internet traffic will never go into the tunnel and thus will never use the webfilter.

DouglasFoster · Answer

First step: ensure that the traffic flows to the web filter. You indicate that this is working, as evidenced by the fact that you can block Facebook. This can be verified or refuted by checking the webfilter logs. 
 Next step: Configure filter rules by user. This is where you seem to be frustrated, and the reason is probably because the VPN User is not detected as a webfilter user. 
 Your Filter Profile configuration is set to Authentication NONE. Consequently, Web Filter will apply the same policy to every VPN user, because this is what you have told it to do. 
 The web filter behavior will be determined by the Policy attached to the Filter Profile and the Filter Action attached to the Policy. If you have neither, the default policy will apply. 
 If you want to do user-specific filtering, you have to find out who the user is. Active Directory is not likely to work -- the users would have to be on domain-joined work laptops using a domain account, but I doubt it would work even in that situation. So you are stuck with the other options: Client authentication, Basic Authentication, or Browser Authentication. Browser Authentication is probably your best bet. 
 Of course, you can have two groups: 
 
 a base group of people that use your existing Authentication None profile, and receive a minimal set of allowed websites 
 one or more specialized groups of people that use a different authentication method and receive an enhanced set of allowed websites.