Suggestions for corporate web filter

T

tuser

n00b
Joined
Feb 17, 2010
Messages
7
Been doing lots of research and was wondering what's recommended for a enterprise environment of around 10k users, active directory integration, fail open, and wan throughout of 1gbps at least. Thanks.
 
you have 10K users routing via one location?

maybe a couple of Cisco IronPort M1070?
 
Last edited:
WebSense is the top of line from what I can gather for Enterprise setups. I think they are run in like 80%+ of Fortune 500 companies.
 
First of all given that most of the discussion I see here centers around linksys, dlink and other soho crap this hardly seems an appropriate venue to field your question. Second you've really not given nearly enough information to answer your question. As was previously said Websense is likely where you going to end up but Websense can deployed in several different ways depending on how you're setup. You could use WS in conjunction with your Blue Coat proxy servers. You could use WS as a standalone product inline or via port spanning. You could use WS via WCCP off a firewall or default gateway. Further there are other options beyond WS. Checkpoint's url filtering is starting to look pretty good though I can't name anyone using it with requirements as large as yours. There are also 3rd party options available from most 1st tier ISP/MSSP.
 
The city of Dallas uses Websense. And they have over 40k users. And as I worked their helpdesk for the last few years I've got some light experience with it. It seems to work very well. It'll keep people off of what you don't want them on, will alert them that they're being blocked, give them whatever message you want such as "contact these people" and so on, deliver reports, and all that. Which most firewalls these days will do. So I can only reccomend Websense via that fact that it hasn't broken since they deployed it about 18 months ago.
 
Unless you have the new Websense Triton.... websense sucks.
We ran 6.3.3 for years and it was nothing but headaches. It had horrible eDirectory integration and its AD integration wasn't much better.
Websense web filter cannot block protocols or any ports other than 80 and 443.

I have demo'ed the following products and overall I feel like Cisco IronPort or m86 would fit your needs.
The cons of iron port though is that even their newest builds can't inspect ports other than 80 or 443. They also can't do protocol blocking (p2p, chat, skype, etc)

M86 can filter in realtime across all ports however it also can't do protocol blocking. They can however analyze HTTP and HTTPS GET requests across any non standard port so if you have a clever user trying to route web traffic over another port M86 will pick it up.
I really like M86's X strikes policy... but their AD integration could use some work. They also have a horrendous web interface that is based on Java and it crashes quite often. I am the only person inside of the interface though so it's only a problem to the people that administer it. On the user facing side it's pretty unobtrusive.
 
cyr0n_k0r said:
Unless you have the new Websense Triton.... websense sucks.
We ran 6.3.3 for years and it was nothing but headaches. It had horrible eDirectory integration and its AD integration wasn't much better.
Websense web filter cannot block protocols or any ports other than 80 and 443.

I have demo'ed the following products and overall I feel like Cisco IronPort or m86 would fit your needs.
The cons of iron port though is that even their newest builds can't inspect ports other than 80 or 443. They also can't do protocol blocking (p2p, chat, skype, etc)

M86 can filter in realtime across all ports however it also can't do protocol blocking. They can however analyze HTTP and HTTPS GET requests across any non standard port so if you have a clever user trying to route web traffic over another port M86 will pick it up.
I really like M86's X strikes policy... but their AD integration could use some work. They also have a horrendous web interface that is based on Java and it crashes quite often. I am the only person inside of the interface though so it's only a problem to the people that administer it. On the user facing side it's pretty unobtrusive.
Click to expand...

nothing can block all those things. Websense comes the closest to it. Its just one piece of the security puzzle. Using Websense alone or anything else alone you won't accomplish much.
A hardware firewall that supports ssl bridging, deep packet inspection will be a nice back up for something like Websense. But you must remember you can't block everything in one time. You'll have to do a couple of months of just going thru data and pin point the problem areas and building your filtering lists. If you start blocking things straight from the go your going to run around trying to patch leaks all over. So the logs is your best friend for a month or two.
 
I agree. we have a 3 tier approach.

We use M86 web filtering for most HTTP traffic. We have another system in place that looks for protocols like p2p and blocks them. We also use Sophos Enterprise to block applications on the desktop. Things like UltraSurf and other proxy programs.
 
Cisco ASA at the edge with L4 Filtering enabled, Bot-Net Filter.

Then use WCCP redirection to Ironport WSA for DLP, virus scan, etc.

Ironport is a great product, and is relatively simple to setup and maintain.
 
You must log in or register to reply here.
Back
Top