What method do You use?

[dkamp]

We need to limit which users are allowed to surf the web and also track where they go.
We currently have an ASA5510 Firewall then a Microsoft ISA2004 server for Proxy and authentication by using Active Directory Groups.

1. What are you using?
2. Do you require users to be authenticated to surf?
3. Do you track their history?
4. What do you use to do this?
5. Do you feel this works well for you?

Please take the time and offer your comments....
Thank You!

 

[jpm121]

Just started using a PIX 506 that interfaces to Websense Enterprise, also integrated w/ AD. So far we're very pleased, reporting is good, filtering is very comprehensive.

 

[Rob057]

I have been using a pair of PIX 515e’s for the same purpose. Authentication and logging are a must if you use URL filtering or blocking. It's amazing how quickly people will find a way around any efforts to block their favourite web site! Misuse of the web can lead to disciplinary action in most companies and quite often management will request ‘evidence’ of any internet misuse before they tackle staff about online habits, hence the need to ensure each user authenticates using a unique password to the individual and logs of there surfing stored and archived. This works well for us and staff are made to sign SYOP's on a regular basis, agreeing that they fully understand and will comply with the companies internet access policy.

 

[dkamp]

jpm121 I was not aware that Websense integrated to AD. I will look into this.
Rob057, Are you integrating with AD for authentication?

 

[Rob057]

Authentication for the internet is not done via Active Directory but via a dedicated admission control server

 

[jdeisenm]

What is your goal?

A Block traffic
B count/log
C increase availability

Websense is not cheap, requires quite a bit of space for logging...not to mention application and windows maintence.

If you want to block traffic, Websense works, if you want B and C, use syslog to record url's and get another T1.

Of course, use expands to space alloted. Eventually the next t1 will fill.

I've seen each of these two scenarios.