Account monitoring and monitoring mode failed in "Check Settings" of WFilter.

[Joe]

In the process of testing your product, I have some questions:



Setup: We are using two NICs in the box we are using for this trial. NIC1 is mirroring the port that is running our domain controller that is running vmware hosting a virtual machine running wfilter. NIC2 is plugged into the same switch and used for blocking/ldap. Wfilter is running on Windows XP OS.



1. Updating.

I have my proxy settings set and can browse the web via internet explorer. (the browser your admin console loads in). When I select the option "update now" the site times out and gives the error: "message from web page - error page".



2. Adapters

At random times throughout my testing I will use the "check settings" feature to see if all features are still working correctly. I find that it is a regular occurrence that account monitoring and monitoring mode will have failed. I find the way to fix this is to disable and re-enable NIC2 (blocking NIC).



3. Content Filtering

We have found that the blocking works quite well except I do not know how to get wfilter to pick up key words in browser traffic. Ie: if you go to a pornographic site such as redtube.com, wfilter will not block it unless it is blacklisted, and the site and videos will load successfully, even though there is plenty of sensitive clear text. We find that wfilter will block if there are keywords in the URL, ie: sex.com, but this is not sufficient.



I look forward to your response. We have found wfilter quite good overall.

[admin]

Below is my response to your questions:

1. Updating. We've confirmed that the updating can not work in proxy mode. We will get it fixed in next week.

Currently you can do manully update if you want to upgrade WFilter.

http://blog.imfirewall.us/How+To+Upgrade+Wfilter+Manually.aspx



2. Adapters

If "Monitoring Mode" fails, it indicates that you're monitoring "by mac address" in a multi-segment network. If your network is multi-segment, I recommend you to use "By IP Address" monitoring mode.

For "Account monitoring" checking, it should give a failure reason. What was the reason? Usually, "Account monitoring" fails when WFilter fails to connect to the domain controller. Since it can be resolved by restart the blocking adapter. I guess it might be related to NIC's metric settings. Please check this article and change the NIC's metric settings to make a try:

http://blog.imfirewall.us/Blocking+Adapter+Doesnt+Work+When+Using+Two+Network+Cards+With+WFilter.aspx



3. Content Filtering

WFilter has an url database which includes about 1 million websites. Since there are so many websites in internet, for those websites not in the url database, you can:

1). Using "Url Keywords Filtering" feature to block url by certain keywords.

2). Enable "Auto-categorize" feature in "Category Settings"->"Uncategorized" to categorize websites in real-time or in a scheduled time.

3). You also can add certain domains manually in "Categories List"->"Add websites to a catagory".