Customizing the Sonicwall Content Filter

Tweaking our Sonicwall Gear Continues, and I have to say it responds quite well to our ever changing needs.  Several of our ministries needed our content filtering tweaked for their needs but IT and our Leadership team didn’t want to open entire categories in the filter to allow specific sites across the board especially since are using that content filtering for our core network AND our public Wifi, so enter Sonicwall Single Sign On Agent (SSO).

Sonicwall has offered the SSO agent since the release of version 4 last fall, but it took us quite a while to get this project on the top of the list and get it tested before we deployed it into production.  Basically the SSO agent allows for the user’s Windows workstation to authenticate the user who is logged into that workstation against the firewall.

The configuration process is fairly basic (although because of several issues I won’t say easy). 

What you need to make this happen:

• A Sonicwall Firewall with and active Content Filtering Service subscription and the CFS enabled
• The Sonicwall SSO agent installed on a networked machine (in our case a virtual server)
• A working MS Active Directory structure for your domain.
• User(s) added to groups defined in Active Directory.

The biggest hurdle we had was the SSO agent failing on us.  We would get everything running in our test environment and then the agent service would stop and then there was no web access.  You can set the device to fail open if the SSO agent fails, but we elected to drop down to the default CSF policy for all users if the agent fails.  After we downloaded a more recent version of the SSO agent, moved it to a more stable server and that seemed to resolve that issue.

First you need to adjust the content filter to allow access to the specific sites you want to allow some users to access. 

• The catch, you can’t allow/deny access to a specific url based on the logged-in user or group. To resolve this issue we had to first allow the specific sites we need to access through the content filter. This is a simple white list in the content filter. 
  • Note this excludes the url from all content filters
• Then utilize the firewall, which has the AD group specific granularity you need.
  • Create a firewall rule to allow access to the sites for specified groups and deny for all others.
  • This is all of course only on the authenticated side. Other zones and non Windows machines follow the default rules and provisioned the exceptions by user. Since firewall rules are higher priority than CFS the site can be an exception in the CFS but only those who are in the allow group are able to view the site.