PureSight with the WGIC client?

[Bill.Bowen]

Recently, our company purchased a 25-user PureSight plugin (with a 2-year subscription) for our Wingate 5 Enterprise server. The majority of our users (100+) connect via WIN2K clients using WGIC to securely authenticate with our DC. Can I re-route their WWW traffic through the plug-in via ENS? If not, is there some other way to use this plug-in? I don't have the option of dumping WGIC from the clients...

[labull]

Bill,

PureSight works in conjunction with the WWW Proxy Service.

In WWW Proxy - Sessions Tab - Check the Redirect ENS and WGIC Sessions box. This will route all ENS and WGIC WWW traffic through the WWW Proxy service.

Also be sure that PureSight for WinGate appears in the Plug-Ins Tab of WWW Proxy and is checked.

Let us know how it goes.

Larry

[Bill.Bowen]

Hmmm. That's how my WWW Proxy is configured. The proxy is on port 85 though, instead of 80, because a webserver coexists with Wingate on the same box. Should it work if I redirect "Local computers to the Internet" using port 80 to 0.0.0.0:85 or is there more to it? How can I tell? Thanks.

[labull]

If the WGIC clients are using port 80 for HTTP then I would think they would be getting around the redirection.

The way to tell may be to watch the Activity screen in GateKeeper and see it the connections show as WWW, NAT or WGIC.

Is the locally hosted web site accessed internally, externally or both?

Larry

[Bill.Bowen]

Most webserver traffic (95%) is external.

I have made the port 80->85 redirect and have been watching the traffic. Right clicking on users' http requests in GateKeeper indicates that some of the traffic is going through the WWW Proxy and some is through the Winsock Redirector. Don't understand why they're different but one problem at a time. PureSight doesn't appear to be working anyway. I surfed a few sordid sites for testing purposes, of course. No filtering occurred. I even lowered the plugin slider to 1% on Sex. Still nothing. When I use Proxy Settings in IE to the WWW Proxy, PureSight works.

If I bind the webserver to my external adapter and bind the WWW Proxy to port 80 on the internal adapter, will the WGIC http traffic go through the plugin?

[labull]

If I bind the webserver to my external adapter and bind the WWW Proxy to port 80 on the internal adapter, will the WGIC http traffic go through the plugin?

I'm thinking that's the right answer. Sorry, haven't used WGIC in a long time so I can't be confident.

Hopefully one of the developers (not so subtle hint) will rescue us if we drift too far afield.

Larry

[adrien]

OK, redirection only works on the same port, so if the WWW Proxy wasn't on port 80, then it wouldn't intercept anything useful.

There are a couple of ways around this depending on your web server software.

If you can bind your webserver to a specific interface like you suggest, you should be able to run the proxy on port 80 bound to the internal interface with the server bound to external.

Otherwise, if you can run the web server on another port, you could use an ENS redirect for connections coming in from the internet to redirect to IP address 0.0.0.0 but override the port, and set it to the new port the server is running on.

Adrien

[Bill.Bowen]

Thanks! Got it working, somewhat. Bound the webserver to port 80 of the external adapter. Bound the WWW Proxy to port 80 of the internal adapter. The WGIC http traffic is now driving through the PureSight (& KAV?) plugin. Now I've began encountering other problems.

1. Some sites are being blocked due to their potential sexual/gambling references, regardless of my Allow entry in the plugin configuration. Just how does the Allow function work then? I even have some of my own website being blocked for some inexplicable reason...

2. Internal users can no longer access the restricted areas of our website.

Is there some better documentation for the plugins? What I've got is extremely skimpy...

[labull]

Bill,

If PureSight is working AV should be also.

For entries in the allow list - less is better.

i.e. put in bubbas.com rather than an entire URL. That allows anything with bubbas.com in it to not be subject to PureSight.

Larry

[Bill.Bowen]

The Allow list is not working at all...

[labull]

Does the ban list work?

You could add something like washingtonpost and see if www.washingtonpost.com get blocked.

Larry

[Bill.Bowen]

The Allow list is not working. The Ban list does work. Blocked washingtonpost, as you suggested. Works as advertised.

[Bill.Bowen]

Qbik: Is the ALLOW function broken in PureSight or what? It's not working for us. If it is broken, when is it going to be fixed? Thanks.

[erwin]

Hi Bill

Just gave Puresight a quick once over and the allow list for Puresight plugin is working fine. I agree from the helpfile it is a little light on detail which we will look at, but here is the main points:
(these apply to both Allow and Ban tabs)

1. If you enter a specific URL in the list (e.g www.wingate.com) anytime that URL or a URL containing www.Wingate.com is requested(e.g www.wingate.com/features/sample.html). it will be affected
So as Larry suggested less is better, as sites will often redirect or append most basic URLS when they are requested.

For example if I enter www.sex.com from here in New Zealand the URL is changed by the Webserver to www.sex.com/newzealand, but because I had entered simply sex.com on the Ban tab, this site is also blocked.

2. If you add single words to the allow/ban lists, URL'S containing these words will also be affected, so as an example, entering "com" in the ban list will result in blocking all .com sites.

3. If there are already sites specifically banned in the Banned sites of the WWW proxy service, this will overide any sites that you may put in the "allow" tab of Puresight filter.

Hope this helps

Erwin