User Guide. Cloud Gateway Software Device

Transcription

1 User Guide Cloud Gateway Software Device This document is designed to provide information about the first time configuration and administrator use of the Cloud Gateway (web filtering device software). Every effort has been made to make this document as complete and accurate as possible, but no warranty or fitness is implied. CensorNet Ltd does not accept any liability for poorly designed or malfunctioning networks. 1

2 TABLE OF CONTENTS Overview... 4 Network Positioning... 5 Best practices... 5 Firewall... 5 Requirements... 6 Installation... 7 Installing the system... 7 Configuration Logging in Navigation Overview Service Status Resource Status Captive Portal Activity Browsing Activity Network Interfaces Cloud Connection Gateway & DNS Servers Authentication Deciding which authentication method to use Active Directory to Cloud authentication Step 1 Join the gateway to Active Directory domain Step 2 Create encryption keys Step 3 Create a DNS entry Step 4 Configure web browsers Obtain keys on client computers Cache access denied error

3 Direct to Cloud authentication Captive Portal Configuring web browsers to use Cloud Gateway Manually configure web browser proxy settings Best practice for deploying the Cloud Gateway proxy User mapping Creating new mappings Troubleshooting Managing existing mappings System Time Settings Captive Portal Backup & Restore Change Password Shutdown or Reboot

4 OVERVIEW The Cloud Gateway software appliance is part of the hybrid Cloudwebfiltering.com architecture and is designed to be installed on-premise and provide local devices (managed and unmanaged) with filtered Web internet access. Web dashboard CLOUD BASED SERVICE ICAP ICAP Roaming laptop (3G/4G) Roaming laptop (Wi-Fi) Captive Portal ICAP ICAP Guest laptops Smartphones Head Office Branch office Cloud Gateway Cloud Gateway Tablets Active Directory Single sign on Network Network The Cloud Gateway works by providing a direct proxy or intercepted proxy connection for locally connected devices. The Cloud Gateway then relays snapshots of web requests to the cloud (no proxying takes place here) to decide on whether access to a particular web site should be granted or not. After installation, management of users, policies and reports takes place via the Cloudwebfiltering.com portal as normal. You can deploy multiple Cloud Gateway devices around your network, for example you could have one in each branch office. For roaming users, the Cloud Link client software can be installed which will provide the exact same experience as Cloud Gateway when the device is outside of the network. NOTE: If you decide to use Cloud Link then do not configure the device for use with Cloud Gateway as it is not necessary. Cloud Gateway is available as a software image (.ISO) and should be installed on a dedicated physical or virtual machine. 4

5 NETWORK POSITIONING The Cloud Gateway device should be positioned before the firewall. The Cloud Gateway supports multiple network interfaces allowing you to connect various networks for filtering. Unmanaged devices (e.g. devices where you are unable to configure proxy settings) will need their gateway set to the IP address of Cloud Gateway in order for traffic to be intercepted. This should be handled by the DHCP server. The following diagram illustrates a typical network deployment: Local network CLOUD BASED SERVICE Captive Portal Smartphones Guest laptops Active Directory ( ) Core switch Web browser proxy set to TCP port 1344 Tablets Guest network (Gateway set to ) Cloud Gateway (Net 1: Net 2: Gateway: ) Firewall ( ) BEST PRACTICES Managed devices should have their web browsers configured to use the proxy server on Cloud Gateway and keep existing gateway settings. Unmanaged devices should have their gateway changed to the IP of Cloud Gateway (on the appropriate interface) using an appropriate method such as DHCP. Unmanaged devices should install the SSL Certificate to avoid problems accessing some HTTPS web sites (downloadable from Captive Portal splash page). If using the Captive Portal, ensure that you have appropriate Terms of Service in place to cover web filtering and SSL web site filtering. For roaming users (e.g. laptops/netbooks) consider installing the Cloud Link client software instead. If you are planning to use Active Directory authentication, set the Primary DNS and NTP server setting on Cloud Gateway to be the IP address of your Active Directory server. FIREWALL For the Cloud Gateway device to operate correctly TCP PORT 1344 must be open for outbound connections from the Cloud Gateway server. In addition, TCP PORT 80 AND 443 must be open for outbound connections from devices running the Cloud Link client software. See note on BEST PRACTICE FOR DEPLOYING THE CLOUD GATEWAY PROXY later in this document. 5

6 REQUIREMENTS A valid Cloudwebfiltering.com account Dedicated server or virtual server x86 64-bit CPU or above (see 2GB RAM 8GB Hard Disk space At least one Ethernet port Internet Explorer 9, Firefox 11 or Chrome 11 and above CLOUD GATEWAY CANNOT BE USED WITH A PARENT (UPSTREAM) PROXY AT THIS TIME. 6

7 INSTALLATION INSTALLING THE SYSTEM INTERNET ACCESS IS REQUIRED DURING INSTALLATION. THE NETWORK SETTINGS CONFIGURED DURING INSTALLATION MUST BE VALID FOR SUCCESSFUL INSTALLATION. Once you boot from the installation CD you will be prompted to select the language to use. Select the appropriate option from the list and press ENTER. The Cloud Gateway splash screen will be displayed. Press ENTER again to start the installation. The console based installer will appear. To select options use the CURSOR KEYS, to move between options press the TAB key and press ENTER to confirm your selection. 7

8 Select the desired language and press ENTER. Select the geographic location where the Cloud Gateway server is located and press ENTER. Next you will be prompted to detect the keyboard layout. Press ENTER to skip automatic detection. 8

9 Now select the correct country for your keyboard from the list and press ENTER. Next select the best layout that corresponds to your keyboard and press ENTER. 9

10 The installer will now copy files required for installation. This process can take up to a few minutes depending on the speed of the machine. Once complete, you will be prompted to enter an IP address for the Cloud Gateway server. Type the IP address in one of the supported formats and press ENTER. 10

11 You will then be prompted to enter the subnet mask. Enter the correct subnet mask and press ENTER. Next you will be prompted to enter in the default gateway. Enter the default gateway and press ENTER. 11

12 You will then be prompted to enter in at least one DNS server. You may enter up to three DNS servers separated by spaces. Press ENTER. Next you will be prompted to enter a hostname for the Cloud Gateway server. This will form part of the Fully Qualified Domain Name of the server. The hostname can be changed later if required. Enter the hostname and press ENTER. 12

13 You will then be prompted to enter in the domain name for the Cloud Gateway. At this stage, it is acceptable to simply enter in the hostname again followed by ".local" then press ENTER. For security, you are required to create an operating system user account for the Cloud Gateway server. This allows you to access the Linux command line directly. Enter a suitable real name for the account, such as "System Administrator" and press ENTER. 13

14 Next you will be prompted to enter a username for this user - the default is guessed based on the previously entered real name. Enter a username and press ENTER. MAKE A NOTE OF THE USERNAME AND KEEP IT SAFE - THIS ACCOUNT IS USED FOR MAINTENANCE, TECHNICAL SUPPORT AND UPGRADES. You will then be prompted to enter a password for the account. A good password should contain a mixture of letters, numbers and punctuation. Enter the password and press ENTER. MAKE A NOTE OF THE PASSWORD AND KEEP IT SAFE. 14

15 You will be prompted to re-enter the password. Re-enter the password and press ENTER. Next, the installer will attempt to guess the time zone. If the time zone is correct, press ENTER otherwise use TAB to select NO and select the correct time zone. 15

16 Next, the installer will prompt to create partitions on the server hard disk. NOTE: THIS STEP WILL ERASE ALL OF THE DATA ON THE HARD DISK AND INSTALL THE CLOUD GATEWAY OPERATING SYSTEM. If you are happy to proceed press ENTER. Confirm again that you are happy to ERASE ALL DATA FROM THE HARD DISK. Press TAB to select YES and then press ENTER. 16

17 The Cloud Gateway operating system will now be installed. This may take several minutes. DO NOT INTERRUPT THE INSTALLATION PROCESS. Next you will be prompted to enter a password to secure the web interface on the Cloud Gateway. Enter a password and press ENTER. KEEP THIS PASSWORD SAFE AS YOU WILL NEED IT TO ADMINISTER THE CLOUD GATEWAY SERVER AFTER INSTALLATION. 17

18 You will then be prompted to re-enter the web interface password. Re-enter the password and press ENTER. The Cloud Gateway software will now be installed. This may take several minutes. 18

19 Finally, you will be prompted to installed the boot loader. Press ENTER to install the boot loader. The installation process will then finish and you will be prompted to remove the installation CD from the drive. The server will then reboot. Press ENTER to finish the installation. 19

20 20

21 CONFIGURATION LOGGING IN The Cloud Gateway device is configured using a web based interface. Point your web browser at the IP address configured during installation of the Cloud Gateway. You will be presented with the login page, as shown below. Enter the password configured during installation or if that password fails, try leaving the password blank and pressing LOGIN (remember to set a new password via the System / Change Password menu option). NAVIGATION Navigating the Cloud Gateway web interface is straight forward. Use the buttons along the top right of the screen to switch between sections. To log out, click the LOG OUT link in the top right hand corner or close the browser window. 21

22 OVERVIEW The OVERVIEW page contains a snapshot of the Cloud Gateway status. NOTE: AFTER FIRST TIME INSTALLATION THE OVERVIEW PAGE MAY SHOW ERRORS. THIS IS NORMAL AND THE STATUS WILL CHANGE ONCE THE SYSTEM IS CONFIGURED. The OVERVIEW page is dynamic and will automatically update without you needing to refresh the web browser. Hovering over elements of the OVERVIEW page will reveal more information if it makes sense to do so e.g. there is an error condition. SERVICE STATUS The SERVICE STATUS panel lists the critical services running on the Cloud Gateway. This information is updated every few seconds. The services checked are as follows: Internet access this indicates whether or not the gateway can connect to the Internet. Internet access is required for the system to operate correctly. Cloud service this indicates whether the gateway can communicate with the cloud service. To configure this, please see the Network section of this document. Proxy service this indicates whether the proxy service on the gateway is running. The proxy provides web access for local browsers and user authentication. System services this indicates whether the core system service is operational. The system services are responsible for configuring backend processes. RESOURCE STATUS The RESOURCE panel shows the current system resource levels on the Cloud Gateway. This information is updated every few seconds. The resources checked are as follows: Uptime the time since the last reboot of the Cloud Gateway system. Load a CPU utilisation graph. Used RAM the amount of physical memory used, shown as a percentage. The bar will change to yellow and red to indicate warning and critical levels. Used disk the amount of hard disk space used, shown as a percentage. The bar will change to yellow and red to indicate warning and critical levels. CAPTIVE PORTAL ACTIVITY If the CAPTIVE PORTAL feature is enabled then active users in the previous hour will be displayed here. Hovering over a user will display further information such as IP address, MAC address and log in time. See the Captive Portal section of this document. 22

23 BROWSING ACTIVITY This graph shows the browsing activity for all users on the connected Cloud account (see Network section). NOTE: THIS GRAPH SHOWS ACTIVITY FROM ALL USERS ACROSS ALL CLOUD GATEWAY DEVICES AND CLOUD LINK CLIENTS. THIS GRAPH IS NOT LIMITED TO A SINGLE CLOUD GATEWAY DEVICE. The graph is a mirror image of the PRODUCTIVITY MONITOR in the Cloudwebfiltering.com dashboard. The graph shows the previous 24 hours of browsing activity. Allowed these are visits to web sites that have been allowed by the configured filtering policies. Blocked these are visits to web sites that have been blocked by the configured filtering policies. Mixed these are visits that contain both allowed and blocked content, for example this could be advertising banners blocked on a news web site. The graph automatically updates on the hour, every hour. Hovering over a point on the graph will reveal the actual visit count as a tooltip. 23

24 NETWORK The NETWORK section allows you to configure network interfaces that are connected to the gateway, basic network settings for connectivity and the credentials to link the gateway to a Cloudwebfiltering.com account. INTERFACES The Cloud Gateway supports multiple network interfaces although only one is required for normal operation. Typically, these interfaces will connect the gateway to multiple network segments, so that web traffic on those networks can also be filtered. You can add as many interfaces as required to the Cloud Gateway. When the gateway boots up, it will scan all available interfaces and make them available via the Network option of the web interface. To configure an interface, click on the interface name and the accordion will expand to reveal more options. There must be at least one network interface present in the server for normal operations this is usually called eth0. For each interface, it is possible to configure a name which is used to identify the interface more easily than using the abbreviated reference, i.e. eth0. You can also specify an IP address and subnet mask for the interface to listen on. This allows devices on that network to communicate with the Cloud Gateway. If necessary you can also force the interface UP (active) or DOWN (inactive) from this section. 24

25 CLOUD CONNECTION In order for the Cloud Gateway to operate it must have a valid connection to the Cloudwebfiltering.com service. You will need a valid username and password with admin rights in order for the Cloud Gateway to connect. Contact your service provider for this information. The following options must be configured: ICAP server domain this information is given to you with your Cloudwebfiltering.com account. Typically for customers in the UK & Europe this will be cloudwebfiltering.com. For customers in North America, Canada and Central America, this will be us.cloudwebfiltering.com. ICAP server IP address this box will be filled in automatically. Admin username this is a username with admin rights. It must be set up within the Users & Groups section of your Cloudwebfiltering.com account. Admin user password this is the password associated with the ADMIN USERNAME. Re-type Admin user password you are required to confirm the admin user password. Global password this is the Global Password configured in the Account / Global Settings section of your Cloudwebfiltering.com account. Re-type Global password you are required to confirm the GLOBAL PASSWORD again. If you are unsure of any of the above settings please contact your service provider. NOTE: THE CLOUD GATEWAY WILL NOT OPERATE WITHOUT THE CLOUD CONNECTION OPTION CONFIGURED WITH A VALID CLOUDWEBFILTERING.COM ACCOUNT. 25

26 GATEWAY & DNS SERVERS During installation you will be prompted to enter the network configuration for the Cloud Gateway. Post installation, you can change those settings in the GATEWAY & DNS Servers option. Default gateway this is the default gateway the Cloud Gateway will use for Internet access. Gateway hostname this is the host name of the Cloud Gateway server. Default is CLOUDGW. A valid hostname is required for Active Directory authentication and will form part of the Fully Qualified Domain Name (FQDN) of the Cloud Gateway server. Primary DNS server this is the primary DNS server that the Cloud Gateway will use for name resolution. NOTE: FOR BEST PERFORMANCE USE A LOW LATENCY DNS SERVER. Secondary DNS server this is an alternative DNS server that the Cloud Gateway will use if the PRIMARY DNS server is unavailable. 26

27 AUTHENTICATION All connections to the Cloud Gateway must be authenticated either directly with the Cloudwebfiltering.com service or via Active Directory. In order for browser based authentication to work (single sign on or prompted), the web browser must be configured to use the proxy that runs on the Cloud Gateway service. Browser settings can be configured manually, by Group Policy or via WPAD (Web Proxy Auto Discovery) and each of these methods are described later in this section. DECIDING WHICH AUTHENTICATION METHOD TO USE The Cloud Gateway currently supports two proxy based authentication methods ACTIVE DIRECTORY TO CLOUD and DIRECT TO CLOUD. The Cloud Gateway also provides a CAPTIVE PORTAL to authenticate connections that are transparently intercepted on a network interface. If enabled, the CAPTIVE PORTAL is available on all network interfaces configured in the Network section. All three methods are described below: Active Directory to Cloud this method provides single sign on authentication between the browser, Cloud Gateway and Active Directory and is the recommended option if you have a Windows domain. If you plan to use ACTIVE DIRECTORY TO CLOUD mode, you must: o Create static user mappings between users on Active Directory and users in the Cloudwebfiltering.com service see the User Mappings section. o Use the fully qualified domain name (FQDN) of the Cloud Gateway in the browser proxy settings (not the IP address) on port TCP port o Ensure the time on the Cloud Gateway see the Time Settings section is no more than 5 minutes apart from the time on the Active Directory server. Direct to Cloud this method prompts the user to manually enter their Cloudwebfiltering.com username and password whenever they open a web browser window. This method is suitable for non-domain environments. Like Active Directory, you must configure the web browser proxy settings to use the hostname or IP of Cloud Gateway and TCP port Captive Portal this method prompts the user to manually enter their Active Directory (if Active Directory Cloud authentication is configured) or Cloudwebfiltering.com (if Direct to Cloud authentication is configured) username and password when the web browser is opened for the first time. Users will be required to log back in after 15 minutes of inactivity. Unlike the DIRECT TO CLOUD method, which uses the web browser authentication prompt, the CAPTIVE PORTAL displays an inbrowser logon page which can be customised see Captive Portal section. The CAPTIVE PORTAL method is ideal for guest devices because unlike the other methods it does not require the browser to be configured with proxy settings. However, if you use the CAPTIVE PORTAL mode, you should ensure that you install the SSL certificate to avoid problems with some HTTPS web sites. The SSL certificate is available to download from the CAPTIVE PORTAL login page or from NOTE: IF THE CAPTIVE PORTAL IS ENABLED IT WILL OPERATE ON ALL NETWORK INTERFACES. If you want to exclude a computer from requiring authentication use one of the following methods to ensure the web requests do not reach the Cloud Gateway: Issue a different gateway for the computer to bypass the Captive Portal e.g. static DHCP entry Use WPAD (Web Proxy Auto Discovery) to send requests from the computer directly to the Internet rather than to the Cloud Gateway proxy. Add an entry in the web browser proxy exceptions for the site you do not want to authenticate/filter. 27

28 ACTIVE DIRECTORY TO CLOUD AUTHENTICATION Setting up ACTIVE DIRECTORY TO CLOUD authentication is a four step process and assumes that you have already configured a valid Cloudwebfiltering.com account - see Network settings. STEP 1 JOIN THE GATEWAY TO ACTIVE DIRECTORY DOMAIN If you have never attempted to join the gateway to your domain before, click JOIN DOMAIN. If you are not sure if a relationship exists, click TEST DOMAIN to verify. If the verification fails with Join to domain not valid then proceed with clicking JOIN DOMAIN. The options are as follows: Active Directory server IP address this is the IP address of your Active Directory server (the one you want to authenticate against). Active Directory server hostname this is the hostname of the Active Directory server. This is just the name of the server, not the fully qualified domain name. 28

29 Active Directory domain name this is the fully qualified Active Directory domain name WITHOUT the hostname at the beginning. Active Directory container this is where the Cloud Gateway machine account will be created on your Active Directory server. By default, leaving this option blank will place it in the Computers OU. If you require a specific path, specify it from the tree root in the format PATH/TO/OU (note the use of forward slashes rather than back slashes) Domain admin username this is the username of an account on the domain with administrator privileges (member of DOMAIN ADMINS). Domain admin password this is the password of the user specified in DOMAIN ADMIN USERNAME. The password cannot contain any special characters, such as a % sign. Click JOIN to attempt to join to the domain. If the join is successful, you will see the message Joined <HOSTNAME> to realm <DOMAIN>. If the join fails, check the settings above and consult with your network administrator. Tick the TURN ON DEBUGGING checkbox and try again this may highlight the problem area in more detail. Verify the join is successful by clicking the TEST DOMAIN MEMBERSHIP button. If successful, you should see the following: STEP 2 CREATE ENCRYPTION KEYS Creating a set of encryption keys on the domain allows the Cloud Gateway to authenticate domain users automatically. Click the CREATE KEYS button and then LIST KEYS. If successful, you should see a key set similar to the one below: 29

30 If there is an error, double check that Step 1 has been successful. You can also try clicking FLUSH KEYS first and also attempt to CREATE KEYS with debugging enabled. STEP 3 CREATE A DNS ENTRY In order for the single sign on authentication to work correctly you must reference the Cloud Gateway proxy by its fully qualified domain name and not its IP address. For this to work, you must create an A record on your DNS server for the FQDN and point it to the Cloud Gateway IP address. 30

31 On Windows Server, go to Start -> Administrative Tools and click DNS Manager. For further assistance please contact your network administrator. STEP 4 CONFIGURE WEB BROWSERS The final step is to configure the web browsers on your network to use the Cloud Gateway proxy see Configuring web browsers to use Cloud Gateway. Proxy settings should use the FQDN (e.g. cloudgw.ad2008.local) and port 8080, for example: OBTAIN KEYS ON CLIENT COMPUTERS Please log out and log back in any domain users and then open a web browser configured to use the Cloud Gateway proxy. If authentication fails, you can verify that the computer has a valid kerberos ticket by opening a COMMAND PROMPT and typing KLIST. The HTTP key should match the FQDN of the Cloud Gateway, e.g: 31

32 CACHE ACCESS DENIED ERROR This error will appear if you have configured Active Directory authentication but you do not have a valid mapping between the domain user (local user) and a cloud user - see User Mapping. DIRECT TO CLOUD AUTHENTICATION DIRECT TO CLOUD authentication is not a single sign on method. With this method configured, users will be prompted to authenticate using the in-built browser authentication pop-up screen (used for BASIC authentication common on many web sites). Users must then enter a username and password from the connected Cloudwebfiltering.com account to access the web. To enable this method, simply click ENABLE and then configure web browsers to point to the Cloud Gateway proxy see Configure web browsers to use Cloud Gateway. CAPTIVE PORTAL The CAPTIVE PORTAL can be enabled or disabled. THE CAPTIVE PORTAL SHOULD NOT BE ENABLED ON UNSECURED WIRELESS NETWORKS. WPA1/2 SECURITY SHOULD BE USED AS A MINIMUM OR AN SSL SERVER CERTIFICATE IS REQUIRED FOR THE CAPTIVE PORTAL. 32

33 If it is enabled, the CAPTIVE PORTAL listens on all available network interfaces for connections to port 80 and 443, intercepts them and redirects them to the CAPTIVE PORTAL login page. This is ideal for guest devices where configuring proxy settings is not possible or desirable. Users wishing to browse the web are required to enter a valid username and password from the configured Cloudwebfiltering.com account. The default CAPTIVE PORTAL login form is shown below: The login page can be customised see Captive Portal section. TO AVOID PROBLEMS WITH HTTPS WEB SITES IT IS RECOMMENDED THAT THE GUEST DEVICE INSTALLS THE SSL CERTIFICATE WHICH IS AVAILABLE TO DOWNLOAD FROM THE LOGIN PAGE. CONFIGURING WEB BROWSERS TO USE CLOUD GATEWAY There are numerous documented methods for applying web browser proxy settings. The most common options are described below. MANUALLY CONFIGURE WEB BROWSER PROXY SETTINGS All modern web browsers support web proxies and the settings can usually be found in the OPTIONS menu. Examples are shown below. INTERNET EXPLORER Open Internet Explorer and go to Tools menu then select Internet Options. Click the Connections tab and then LAN SETTINGS. 33

34 MOZILLA FIREFOX Open the Tools menu and click Options and then Advanced tab. Click the Network tab and then SETTINGS. AUTOMATICALLY CONFIGURE WEB BROWSER PROXY SETTINGS USING GROUP POLICY If you are running an Active Directory domain you can use GROUP POLICY to configure Internet Explorer proxy settings automatically. 34

35 On your Active Directory server, follow these steps: 1. Open the MMC console. 2. Add the GROUP POLICY snap-in. 3. Select either DEFAULT DOMAIN POLICY or the appropriate policy for your users, as the GROUP POLICY OBJECT. 4. Navigate to the Users / Configuration / Windows Settings / Internet Explorer Maintenance / Connection option in the left hand pane. 5. Edit the proxy settings options to use the Cloud Gateway FQDN and port number as described earlier in this document. 6. Push the changes out to your users. NOTE: SOME USERS MAY NEED TO REBOOT OR RUN "GPUPDATE /FORCE" FOR THE PROXY SETTINGS TO TAKE EFFECT. For Mozilla Firefox users there is a Group Policy add-on available: USING WEB PROXY AUTO DISCOVERY TO AUTOMATICALLY SET THE PROXY SETTINGS The WEB PROXY AUTODISCOVERY PROTOCOL (WPAD) method is used by web browsers to locate a proxy on the network and configure it automatically using an auto-configuration (.pac) file. The.pac file is issued via DHCP or via DNS and the web browser should have the option to AUTOMATICALLY DETECT A PROXY SERVER enabled. For further information and extensive documentation please visit: BEST PRACTICE FOR DEPLOYING THE CLOUD GATEWAY PROXY It is recommended that you block connections from your local computers to TCP ports 80 and 443 and only allow connections from the Cloud Gateway server IP address to these ports. This will ensure that only web browsers configured to use the proxy correctly can access the web and therefore avoid circumvention of the filtering. 35

36 USER MAPPING Usernames in the Cloudwebfiltering.com service are identified by addresses. Users in Active Directory have a different naming convention. In order to associate an Active Directory user with a Cloudwebfiltering.com user, a user mapping is required. User mappings are created manually unless the users in Active Directory have the field configured in their account profile. If so, it is possible to automatically create the mappings, which can save time. The Cloud Gateway can also automatically create users on the Cloudwebfiltering.com service that don t already exist provided there are sufficient licenses available, meaning you don't have to create the user accounts manually in the cloud. IN ORDER TO CREATE NEW MAPPINGS PLEASE ENSURE YOU HAVE CONFIGURED THE CLOUD CONNECTION IN THE "NETWORK" MENU OPTION AND YOU HAVE SELECTED "ACTIVE DIRECTORY TO CLOUD" AUTHENTICATION IN THE "AUTHENTICATION" MENU OPTION. CREATING NEW MAPPINGS Clicking on the NEW MAPPING tab will automatically load users from the Cloudwebfiltering.com service into the CLOUD USER ACCOUNTS TREE. If this does not happen, check the CLOUD CONNECTION settings in the Network menu option. 36

37 MANUALLY CREATE A USER MAPPING Creating a new mapping involves 3 steps, which are outlined as follows: 1. Refresh THE LOCAL USER ACCOUNTS TREE by clicking REFRESH below it. You will be prompted to enter the Active Directory server administrator password. If successful, the Active Directory users will appear. Click a user in the LOCAL USER ACCOUNTS TREE. 2. Click the corresponding user in the CLOUD USER ACCOUNTS TREE. If there is no corresponding user, create one in the Cloudwebfiltering.com account under USERS & GROUPS and then refresh the CLOUD USER ACCOUNTS TREE. 3. Click ADD MAPPING. TROUBLESHOOTING LOCAL USER DOES NOT CONTAIN AN AUTHORISED DOMAIN This error occurs if the Active Directory user selected has an domain in the " " setting of the account profile that does not match a list of authorised domains for your Cloudwebfiltering.com account. You can view a list of authorised domains in the Account / Global Settings option of your Cloudwebfiltering.com account. THE LOCAL USERNAME OR THE ADDRESS IS ALREADY PART OF A LOCAL MAPPING This error occurs if you attempt to add a local username or address which has already been used in a mapping. Local users and cloud users have a one-to-one mapping. You cannot map multiple local users to a single cloud user. AUTOMATICALLY MATCHING USERS It is possible to automatically match local and cloud users and optionally create non-existent cloud users. NOTE: THIS FEATURE REQUIRES THAT THE ACTIVE DIRECTORY USER HAS THE " " PROFILE FIELD COMPLETED WITH AN ADDRESS THAT IS VALID FOR THE CLOUDWEBFILTERING.COM ACCOUNT IN USE. To perform the auto-match: 37

38 1. Ensure that the LOCAL USER ACCOUNTS TREE is up to date by pressing REFRESH below it. 2. Ensure that the CLOUD USER ACCOUNTS TREE is up to date by pressing REFRESH below it. 3. Click PERFORM AUTO-MATCH to attempt to match Active Directory users to Cloud users 4. Review the auto-matched users and click RUN. MANAGING EXISTING MAPPINGS You can make changes to existing mappings on the Cloud Gateway by selecting the User mapping menu option and then the EXISTING MAPPINGS tab. You can delete a mapping by clicking on it and pressing DELETE MAPPING. You can edit a mapping by double-clicking on it, making the change, and pressing the ENTER key. 38

39 39

40 SYSTEM TIME SETTINGS IT IS VERY IMPORTANT THAT THE TIME AND TIME ZONE ON THE CLOUD GATEWAY IS CORRECT AS IT IS USED AS PART OF THE AUTHENTICATION SECURITY. On this page you configure the following: Current time zone - this should be set to the correct local time zone where the Cloud Gateway is installed. NTP server - this should be set to the address of a publically available NTP server (e.g. pool.ntp.org) or local NTP server (e.g. running on Active Directory server). Current server local time - this allows you to set the date and time manually if you decide not to use NTP. NTP is the recommended option. 40

41 CAPTIVE PORTAL It is possible to customise parts of the CAPTIVE PORTAL login page, for example the title, logo, introductory text and link to terms of service. On this page you can configure the following: Captive portal title - the title that appears at the top of the CAPTIVE PORTAL login page. Logo - a logo to appear in the top right hand corner of the CAPTIVE PORTAL login page. This must be a valid URL to an image hosted on a web server. Introduction/welcome text - this allows you to enter a welcome message that will appear on the CAPTIVE PORTAL login page. Terms of service text - this text will appear beside a checkbox that the user must tick in order to gain access to the web. It should be short and succinct. Leaving this blank will disable the checkbox. Link to Terms of Service - this allows you to link to an external document containing the Terms of Service. This can be any valid URL and will open in a new window when clicked. Click "Reset to default" to remove all customisations and display the default CAPTIVE PORTAL login page. 41

42 BACKUP & RESTORE It is important that you back up the Cloud Gateway configuration in case at some point the server needs to be re-installed or upgraded. To backup the Cloud Gateway server click DOWNLOAD BACKUP. Ensure that you store the backup file in a safe place. The backup contains all the settings on the Cloud Gateway excluding the Active Directory authentication trust relationship and keys as it is not possible to transfer these settings between machines. To restore a backup select a backup file from your computer and click RESTORE BACKUP. After restoring a backup, it is recommended that you reboot the Cloud Gateway using the Shutdown Or Reboot menu option. Once rebooted, you should follow the steps in the Authentication section of this document to enable authentication again. CHANGE PASSWORD If you need to change the password used to access the Cloud Gateway web control panel you can do it on this page. The change will take effect the next time you log in to the web interface. SHUTDOWN OR REBOOT From time to time it may be necessary to shut down or reboot the Cloud Gateway server. It is recommended that you use the options on this page as they are designed to shut down the server gracefully. Web browsing will be interrupted. 42