Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 5 subscribers
  • Views 3392 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Workgroup User Tracking

WayneBoyles

Hello,

We're slowly migrating some of our clients (and I know I can be asking Sophos support but I figured I'd hit the forums as well as I know there are some pretty bright people on here) off of CheckPoint firewalls (makes me shudder thinking about the problems we've had with those) over to a UTM hardware appliance.

Now, in a larger installation where we may put in an SG unit they typically have Active Directory etc. so user tracking we can do (kind of) - I still haven't gotten it working perfectly but the new STAS in 9.4 looks like it may do what we're needing.

However, we do have cases where it's a much smaller client, maybe 4 users who don't have AD but still benefit from a smaller hardware appliance.  On the CheckPoint we could turn on a feature called User Awareness, and even if you didn't have an AD setup, it would track the local users and you could then create rules, reports etc. around those users.  Is there a way to seamlessly do this on the UTM without having to install the Authentication Client on each machine?

For one it's not hard to right click and select Exit on that and I haven't found a way of locking it so you need a 'master' password to exit out etc.  If I'm missing something there let me know.

This is coming up quite alot as we're moving clients over and we need user tracking and reporting so we can say only PR can access Facebook and everyone else is screwed, or that Jimmy in Engineering has been uploading 3GB of files to his personal DropBox and not only taking up bandwidth but possibly taking confidential material. etc. etc. you get the point :)

Is there a seamless way with the UTM in a workgroup environment?  I find it hard to believe there isn't since the UTM is blowing the CheckPoint away in every other aspect.

Any advice / pointers in the right direction will be appreciated.. 



This thread was automatically locked due to age.
Parents
  • 0

    The XG series can do this some what easy, with a combination of local user accounts and/or clientless users and then build security policies to expect the user identity on each request to ensure that no unauthenticated browsing gets out.

    As for the UTM 9.4, i'd use the Sophos Authentication Agent with UTM Local User accounts created.  But use a paper policy to enforce its use; with the additional help of the Web protection profiles to expect the user to be known for the request, otherwise the packet request falls through to a highly restricted filtering policy.  And firewall rules can expect a 'known client network' (host) address detected by the SAA to also ensure unauthenticated traffic isn't allowed.

    ==

    When in doubt, Script it out.

Reply
  • 0

    The XG series can do this some what easy, with a combination of local user accounts and/or clientless users and then build security policies to expect the user identity on each request to ensure that no unauthenticated browsing gets out.

    As for the UTM 9.4, i'd use the Sophos Authentication Agent with UTM Local User accounts created.  But use a paper policy to enforce its use; with the additional help of the Web protection profiles to expect the user to be known for the request, otherwise the packet request falls through to a highly restricted filtering policy.  And firewall rules can expect a 'known client network' (host) address detected by the SAA to also ensure unauthenticated traffic isn't allowed.

    ==

    When in doubt, Script it out.

Children
No Data
Unfiltered HTML