web filtering software

[PiotrIr]

Hi

I’m looking for good and with reasonable price, web filtering software. I need synchronization with Active Directory + full reporting. It would be nice if the product would be administrator friendly as well

Please advice
Many thanks

[Nuwin]

I use Untangle in my office. It can be free to use after you have supplied the hardware. AD integration is possible, however for a small monthly fee.

The product can do quite a bit more than just web filtering as well.

Open Source Network Gateway | Untangle

[astorrs]

I assume you've looked at Websense Web Filter and Websense Express?

Websense.com - Web security, email security, data security

[homerj742]

Originally Posted by astorrs

I assume you've looked at Websense Web Filter and Websense Express?

Websense.com - Web security, email security, data security

My company also uses this.

[brad-]

Maybe take a look at GFI Web monitor.

[joey74055]

Originally Posted by homerj742

My company also uses this.

I put the Barracuda Web Filter in place. No complaints here, cheap compared to everything else, uses AD for authenication, has reports plus their support has always come through for me. Barracuda Web Filter - Content Filtering and Spyware Protection

[astorrs]

Originally Posted by joey74055

I put the Barracuda Web Filter in place. No complaints here, cheap compared to everything else, uses AD for authenication, has reports plus their support has always come through for me. Barracuda Web Filter - Content Filtering and Spyware Protection

Used those as well and they work fine.

[msteinhilber]

Originally Posted by joey74055

I put the Barracuda Web Filter in place. No complaints here, cheap compared to everything else, uses AD for authenication, has reports plus their support has always come through for me. Barracuda Web Filter - Content Filtering and Spyware Protection

We used a Barracuda Web Filter for several years until our budget was very tight and we were not able to renew it on our renewal anniversary. It ended up being just over 6 months that we had to wait to get the budget allocated to renew. Once we called to place the order and the Barracuda rep verified the details and mentioned we would be good to go until the data that our renewal anniversary was previously. Once your agreement expires, you can no longer get updates which is typical and as a result if I have a device that has a lapsed energize updates agreement for any length of time, I would expect that if I pay $3600 for a year renewal that I get a full year renewal. Instead, the way they work it (as of ~6 months ago) is you pay the full year price but only are extended out to your original renewal anniversary date. In our case, since this was about a 6 month lapse, we would spend $3600 for 6 months of updates. Their argument was we still technically get the updates they released during the 6 months our agreement lapsed (once we renew anyways) so we have to pay for those.

We didn't find that acceptable and switched to Untangle and have been happy since. We get more features and it seems to do a better job overall.

[joey74055]

Originally Posted by msteinhilber

We used a Barracuda Web Filter for several years until our budget was very tight and we were not able to renew it on our renewal anniversary. It ended up being just over 6 months that we had to wait to get the budget allocated to renew. Once we called to place the order and the Barracuda rep verified the details and mentioned we would be good to go until the data that our renewal anniversary was previously. Once your agreement expires, you can no longer get updates which is typical and as a result if I have a device that has a lapsed energize updates agreement for any length of time, I would expect that if I pay $3600 for a year renewal that I get a full year renewal. Instead, the way they work it (as of ~6 months ago) is you pay the full year price but only are extended out to your original renewal anniversary date. In our case, since this was about a 6 month lapse, we would spend $3600 for 6 months of updates. Their argument was we still technically get the updates they released during the 6 months our agreement lapsed (once we renew anyways) so we have to pay for those.

We didn't find that acceptable and switched to Untangle and have been happy since. We get more features and it seems to do a better job overall.

Wow, I didn't realize that. I will need to keep an eye on that anniversary date so as to not lapse. Thanks for the info!

[paintb4707]

Originally Posted by astorrs

I assume you've looked at Websense Web Filter and Websense Express?

Websense.com - Web security, email security, data security

+1 for Websense. I use it here too.

[Forsaken_GA]

Originally Posted by msteinhilber

\ Instead, the way they work it (as of ~6 months ago) is you pay the full year price but only are extended out to your original renewal anniversary date. In our case, since this was about a 6 month lapse, we would spend $3600 for 6 months of updates. Their argument was we still technically get the updates they released during the 6 months our agreement lapsed (once we renew anyways) so we have to pay for those.

That is a horrible business model. What, do they keep increasing the price for new customers, since anyone coming in wouldn't have paid for all previous updates? Sheesh, thanks for the heads up, I'll be sure to mention that if we ever consider using them.

[astorrs]

Originally Posted by Forsaken_GA

That is a horrible business model. What, do they keep increasing the price for new customers, since anyone coming in wouldn't have paid for all previous updates? Sheesh, thanks for the heads up, I'll be sure to mention that if we ever consider using them.

Actually this is a pretty standard business model for support services. If you let them lapse and want to renew them they will do so, but you have to make up the missing time. In fact, nearly every vendor I can think of does this...

[msteinhilber]

Originally Posted by astorrs

Actually this is a pretty standard business model for support services. If you let them lapse and want to renew them they will do so, but you have to make up the missing time. In fact, nearly every vendor I can think of does this...

We have held several maintenance agreements with various A/V vendors (Trend Micro, McAfee, and Symantec) that were existing products in place at offices we had bought out and kept with their existing A/V solution that was lapsed and we renewed. In each instance, once we purchased the maintenance agreement - we received the full amount of time for the agreement we purchased beginning on the date the agreement was issued.

I don't have a lot of experience outside of the A/V software example, but the Barracuda Energize Updates are essentially the same as the maintenance agreement - I'm not talking about the hardware replacement agreement that Barracuda also sells, that one I could see being required to pay for missed time. Perhaps it's common, if it is - I don't agree with it. They advertise and sell it as "Barracuda Energize Updates Subscriptions". If I do not renew at the end of my anniversary, I no longer have a subscription. Six months later, if I renew and pay for a year subscription, I only get six months? I wasn't receiving any benefits for the prior six months of the 1 year subscription I would be purchasing if I renewed so why would I want to pay for them?

[tdempsey]

We use websense and I used to use SurfControl which websense recently purchased. I also have had experience with MimeSweeper for Web which I think went the way of the dodo.
I believe that most of the mainstream web filters tend to get their URL database from Websense. I know that was the case with MimeSweeper and also the webfilter module for Cisco ASA. My only advice is to avoid getting anything that proxies connections and get something more like websense which intercepts the connections and blocks banned content. The reason is that web filter proxies are pigs and can't take too many concurrent connections before you notice severe performance degredation. MimeSweeper used to say one server per 200 connections and that was a stretch. When a proxy filter starts failing, there goes your internet and you have angry customers. When websense fails, it fails open, so you aren't filtering but people can still work.

[arwes]

I almost got Websense Express for my office, but management got cold feet when I suggested that no one should be excluded from the filter, including them. So now I just use the built in proxy on the router to block most social networking sites & bandwidth drains.

[astorrs]

Originally Posted by msteinhilber

We have held several maintenance agreements with various A/V vendors (Trend Micro, McAfee, and Symantec) that were existing products in place at offices we had bought out and kept with their existing A/V solution that was lapsed and we renewed. In each instance, once we purchased the maintenance agreement - we received the full amount of time for the agreement we purchased beginning on the date the agreement was issued.

I don't have a lot of experience outside of the A/V software example, but the Barracuda Energize Updates are essentially the same as the maintenance agreement - I'm not talking about the hardware replacement agreement that Barracuda also sells, that one I could see being required to pay for missed time. Perhaps it's common, if it is - I don't agree with it. They advertise and sell it as "Barracuda Energize Updates Subscriptions". If I do not renew at the end of my anniversary, I no longer have a subscription. Six months later, if I renew and pay for a year subscription, I only get six months? I wasn't receiving any benefits for the prior six months of the 1 year subscription I would be purchasing if I renewed so why would I want to pay for them?

There is no upfront cost for the A/V software and 1 year subscription is equal to the renewal cost. Maintenance costs for most other software is usually 15-30% of the upfront cost and hence why they make you pay it back to the initial termination date.

I can see your point since unlike most purely SW vendors, Barracuda sells theirs as a hardware appliance bundled with the initial license but all software updates come via a separate subscription. I guess they had to select one of those models and unfortunately that's the one they went with. I would probably argue pretty heavily against them if I ended up in that situation too, I would be okay with backdating the hardware maintenance agreement, but not the update subscription.

[Kasor]

WebSense is the best...! (almost)

[cisco_trooper]

Try also the St. Bernard iPrism. The only device I like better so far is WebSense from a network implementation perspective in a High Availability environment. Our Microsoft guys seem to like it better than WebSense as far as policies go.

[Urchin]

Originally Posted by PiotrIr

I’m looking for good and with reasonable price, web filtering software. I need synchronization with Active Directory + full reporting. It would be nice if the product would be administrator friendly as well

Take a look at SafeSquid. It is a content filtering proxy for Linux and Windows. While most other 'content filtering' options only let you allow / block access to websites based on the category they belong to, SafeSquid lets you do much more than that.

Check out these SafeSquid howtos to get an idea -
Search | HowtoForge - Linux Howtos and Tutorials

And the best part is, SafeSquid is offered free for small organizations, with less than 21 users, but the Linux version. Even the commercial editions are reasonably priced, with perpetual licenses. And yes, it has a browser based interface for management.

[NightShade03]

+1 for websense it is amazing in its flexability and is very good. I will warn on one thing though it doesn't play nicely in multi-domain/multi-forest layouts. Someone correct me if they have had luck with this....but it took us almost 2 months of back and forth with them to get the second forest to work with the filter. But once working its great.

[Megadeth4168]

+1 for websense!

I administer our Websense servers here and I love it! It's easy to administer, the reporting tools are great and it allows extremely flexible policy control.

[tdempsey]

I have noticed with Websense and even more so with SurfControl that the webfilter service would periodically become overwhelmed and needed to be restarted. When it was in this overwhelmed state, the filter would intermittently stop filtering and let stuff pass and then after restarting, it would begin blocking again. Secondly, I have noticed that reporting would occasionally stop working and there would be chunks of time missing from the reports. That being said, I still don't know of anything better on the market. I almost feel like the reporting is too good with Websense and Surfcontrol. As long as the filter is working and pages are getting blocked like they are supposed to I am happy. There were managers out there that wantes to know their peoples every move and they were requesting detailed reports from me on their people but I think they were wasting their time and there are better ways to gauge productivity than by looking at their internet activity. I also set alerts for certain high risk behaviors only to find that upper management was being held to a different standard than the rest of the company. There was a VP that enjoyed perusing escort services on Friday afternoon and a CEO that subscribed to a service that allowed him to eavesdrop on his home computer from work. When I brought these up to my manager, he told me to ignore them.

[PiotrIr]

Many, many thanks for your advices.

One of our customers uses Websense and is very happy so I believe it is very good product.

I would like to ask you to give me your opinion about:
1. Messagelabs Web Filtering – quite interesting solution as hosted.
2. Untangle – price is amazing so I wonder, what is significant difference between Websense and Untange?

Many thanks.

[94jedi]

we used to use Surf Control but they were bought out by Websense. We've been dragging our feet on migrating over to WS.

[coffeeking]

Blue Coat here...works great...handles quite a large number of user base and does it fine...authenticates through AD....reporting software is a bit high on CPU usage but other than that its great...but cost could be a point of concern...you can check it out.