Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 6 replies
  • Subscribers 3 subscribers
  • Views 7047 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Exception List Query

isoffice

Hi all,

We are running 2 X SG450 Appliances (Active Passive), Firmware Version 9.404-5.

I have created a Web Filter Profile for a specific VLAN on our internal network. It has a pretty restrictive policy imposed upon it (authentication required, limited categories etc.).

However, there is an appliance on this VLAN (a postal franking machine to be precise) which requires anonymous access to the Internet. I have created an exception in Web Protection - Filtering Options - Exceptions. This exception skips Authentication and SSL Scanning from the IP address of the franking machine. At this point everything works as expected. Web Filter logs indicate that the exception is being applied correctly.

The problem comes when I attempt to add a second parameter to the exception. I want to ensure that no other sites are being accessed from the franking machine except the one that it requires access to. Therefore I created a web site entry in Web Protection - Filtering Options - Websites detailing the site the machine needs to access and Tagged it as a site that can be accessed from the machine.

I then attempted to add this tagged website as a second parameter on the original exception, using the And option.

What now happens is when I attempt to access the site from the source IP address of the franking machine I get prompted to enter user credentials. My understanding of this exception was that providing requests came from the specified source IP address and were destined for the specified tagged website, there would be no need for authentication and SSL Inspection.

Could someone please advise me where I may have gone wrong here or possibly suggest a better way of doing this?

Many thanks in advance,

John P



This thread was automatically locked due to age.
Parents
  • 0

    Assuming for a moment it is doing an HTTPS connection you are being caught between two competing issues.  In order to do the tag matching is must know the full URL (including path).  In order to know the URL it must do HTTPS decryption.  That seems to break your first exception.


    Try instead to create a new profile, high priority, that only applies to the one IP.  Set it to block everything except the tag.  Make sure your tag does not include any path.  I *think* that will work, though it may run into a bit of the same problem.

Reply
  • 0

    Assuming for a moment it is doing an HTTPS connection you are being caught between two competing issues.  In order to do the tag matching is must know the full URL (including path).  In order to know the URL it must do HTTPS decryption.  That seems to break your first exception.


    Try instead to create a new profile, high priority, that only applies to the one IP.  Set it to block everything except the tag.  Make sure your tag does not include any path.  I *think* that will work, though it may run into a bit of the same problem.

Children
No Data
Unfiltered HTML