Web Filtering with Full Transparent Mode on ESXi

The most important documentation about UTM is not in the manual; we forum users have had to write it.   Here is a recommended reading list.   You need a baseline understanding of how UTM works before starting deployment.   UTM does not have security zones like other firewalls, so you need to get into its mindset.   Here is a recommended reading list:

Everything in the Wiki Section

https://community.sophos.com/products/unified-threat-management/w/utm-wiki

Bob Alfson's RULZ document, particularly the part that explains the processing order as a packet goes through UTM.

https://community.sophos.com/products/unified-threat-management/f/general-discussion/22065/rulz

This document on web filtering lessons learned

https://community.sophos.com/products/unified-threat-management/f/web-protection-web-filtering-application-visibility-control/101117/optimizing-web-proxy-lessons-learned

and optionally, this document on log analysis using SQL.

https://community.sophos.com/products/unified-threat-management/f/web-protection-web-filtering-application-visibility-control/101117/optimizing-web-proxy-lessons-learned

Your goal should be to use both web filtering modes.   The reasons why are explained in the Lessons Learned document.   You should distribute the UTM CA certificate to all of your desktops for either web filtering mode.   Transparent mode needs it when https pages are blocked or warned, Standard Mode needs it for all https pages.

As an undocumented feature, a Transparent Mode Filter Profile also enables Standard Mode with the same settings.  If you want to use different settings, create Standard Mode profiles and give them higher priority so that they are evaluated first.    I use AD SSO for Standard Mode and None for Transparent Mode.

In bridged mode, you should specify Full Transparent mode, as you have.  AD SSO does not work with Transparent Mode in a bridged configuration, so you need to use a different authentication method or none.

But to your current problem.   There are only a few possibilities:

• You have not blocked UDP 443 at the firewall, and all of your tests use Chrome with https sites.   Chrome has the 'QUIC' protocol which is ignored by the transparent web filter.   If UDP 443 is blocked, Chrome will switch to TCP 443 and behave like UTM expects.
  
  
• The web filter is turned off.   You assure is that this is not the case.
  
  
• None of the Filter Profiles have the desired IP addresses in the Allowed Networks list.  If the Allowed Networks list is correct, the web filter will do something with the packet.   So this should be an easy fix.   Whether the web filter does what you want will involve other configuration steps, but you have not gotten that far.

The most important documentation about UTM is not in the manual; we forum users have had to write it.   Here is a recommended reading list.   You need a baseline understanding of how UTM works before starting deployment.   UTM does not have security zones like other firewalls, so you need to get into its mindset.   Here is a recommended reading list:

Everything in the Wiki Section

https://community.sophos.com/products/unified-threat-management/w/utm-wiki

Bob Alfson's RULZ document, particularly the part that explains the processing order as a packet goes through UTM.

https://community.sophos.com/products/unified-threat-management/f/general-discussion/22065/rulz

This document on web filtering lessons learned

https://community.sophos.com/products/unified-threat-management/f/web-protection-web-filtering-application-visibility-control/101117/optimizing-web-proxy-lessons-learned

and optionally, this document on log analysis using SQL.

https://community.sophos.com/products/unified-threat-management/f/web-protection-web-filtering-application-visibility-control/101117/optimizing-web-proxy-lessons-learned

Your goal should be to use both web filtering modes.   The reasons why are explained in the Lessons Learned document.   You should distribute the UTM CA certificate to all of your desktops for either web filtering mode.   Transparent mode needs it when https pages are blocked or warned, Standard Mode needs it for all https pages.

As an undocumented feature, a Transparent Mode Filter Profile also enables Standard Mode with the same settings.  If you want to use different settings, create Standard Mode profiles and give them higher priority so that they are evaluated first.    I use AD SSO for Standard Mode and None for Transparent Mode.

In bridged mode, you should specify Full Transparent mode, as you have.  AD SSO does not work with Transparent Mode in a bridged configuration, so you need to use a different authentication method or none.

But to your current problem.   There are only a few possibilities:

• You have not blocked UDP 443 at the firewall, and all of your tests use Chrome with https sites.   Chrome has the 'QUIC' protocol which is ignored by the transparent web filter.   If UDP 443 is blocked, Chrome will switch to TCP 443 and behave like UTM expects.
  
  
• The web filter is turned off.   You assure is that this is not the case.
  
  
• None of the Filter Profiles have the desired IP addresses in the Allowed Networks list.  If the Allowed Networks list is correct, the web filter will do something with the packet.   So this should be an easy fix.   Whether the web filter does what you want will involve other configuration steps, but you have not gotten that far.