AD authentication

RE: AD authentication

zk1 — Wed, 25 Jul 2018 05:15:51 GMT

Thanks again, much appreciated.

RE: AD authentication

Red_Warrior — Tue, 24 Jul 2018 10:37:37 GMT

Most welcome,

If you are referring to pushing out proxy setting via gpo for ff.. Maybe something like this would help https://helpdesk.webtitan.com/support/solutions/articles/4000083786-configuring-firefox-proxy-settings-via-gpo but this involves building your own msi and deploying the pre-configured binary

Generally I would recommend pushing out via dhcp / .pac file for more configuration options (ie exclusions lists, dns/hostname look ups you can detect if the client is onsite vs offsite .. .etc) Its a little more difficult.. Unfortunately support can help much in creating a .pac file.. (if you need one done for you just talk to your account manager for professional services)

However I do have another lovely KB that should help.

NOTE:

(if your in transparent or bridge mode) theres no need for browser settings, just configure the lan router/wccp device to direct 80/443 from network x .. to appliance and then omit the appliance so that it can get out the gateway to the internet.

ELSE:

http://findproxyforurl.com/pac-functions (see the examples here to they are very good)

https://community.sophos.com/kb/en-us/38784

https://community.sophos.com/kb/en-us/38787

https://community.sophos.com/kb/en-us/38783

https://community.sophos.com/kb/en-us/38788

https://community.sophos.com/kb/en-us/38784

RE: AD authentication

zk1 — Mon, 23 Jul 2018 14:54:26 GMT

Thanks Red Warrior!

Re the Firefox config, do you know if it can be done centrally / via policy or similar (so as not to manually configure hundreds of desktops)?

RE: AD authentication

Red_Warrior — Mon, 23 Jul 2018 12:21:08 GMT

Hi Zk1

The SWA officially supports FF, chrome, IE and Safari via SSO... there are some requirements and best practices.. Please see my KB here for everything you need to know https://community.sophos.com/kb/en-us/126599

for thinks like public wifi I generally recommend deploying a separate appliance generally without an authentication policy .. then lock it down via a generic default policy. this will ensure your not mixing public and private traffic. the VM is included so theres no additional costs.

Cheers