SRX

Hi,

we are looking to deploy SRX + Surfcontrol in a distributed environment to replace  Bluecoat/Web Filter.

Currently we using BlueCoat reporter for URL reporting.

What would anyone suggest to use to replace its functionality with ? e.g. STRM or any other product ?

regards,

Michael.

I export to Splunk and use that for very basic reporting.  You'd undoubtely be able to get more from the solution if your Splunk-fu is in any way stronger than mine.  And the Surfcontrol solution cannot filter HTTPS, whether that's an issue.  Instead you'd need to look at the Enhanced web filtering package which utilizes Websense.

HI, I will have a look at Splunk, not looked at it for a long time...

re. HTTPS, I understood that it is now supported (limited), in that destinations can be blocked, but the banner/blocked message cannot be displayed, and the user session is simply terminated.

regards,

Michael.

Hi,

A bit of a hijack here, but I also had the understanding that surfcontrol could block HTTPS.

In fact, I am deplying a solution doing this now. I can get surfcontrol to block https://ebay.com and other sites, but https://facebook.com keeps going through, even if the log says it has blocked the site. facebook.net and fbcdn.com are also being blocked in the "Usenet news" category, so that should not be it. Any ideas?

This is the webfilter log entry:

Aug 20 10:40:59   RT_UTM: WEBFILTER_URL_BLOCKED: WebFilter: ACTION="URL Blocked" 192.168.1.2(49959)->173.252.110.27(443) CATEGORY="Usenet_News" REASON="BY_PRE_DEFINED" PROFILE="surf-control" URL=173.252.110.27 OBJ=/ USERNAME=N/A ROLES=N/A

Still access is allowed...

/Peter