[mjpringles]

Hi Guys,

I'm trying to find out if anyone has managed to get BES to work with WebSense to correctly filter out Internet traffic.

I thought I had cracked it a while back however I have recently discovered that its not working correctly.

I have set MDS to forward all the traffic to the proxy server (which is WebSense sat on top of ISA) and I have edited the wsMSP.ini file to include
IgnoreForwardedRequest=0 under the [configSection].

When my users browser the web using their Blackberry they are prompted for their username and password and if the site they are trying to get to is in the list of allowed sites they get the site otherwise they get a WebSense error message telling them that they are not allowed to view the page.

Fantastic it works! - not quite it seems:

I have users with different levels of Internet access - i.e. Directors have more allowed sites than normal users etc.

User A has the highest level Internet access in the company
User B has the normal level Internet access in the company

When User B surfs the web on his Blackberry it works as intended the user gets blocked from going to sites they are not supposed to.

When User A surfs the web on his Blackberry they get blocked based on User B's Internet level not their own even after clearing the memory of the BB browser and forcing them to re-enter their username and password

Has anyone else come across this or found a better way of Web Filtering on Blackberries??

Many Thanks

mjpringles

[CanuckBB]

I believe Websense sees all request coming from BESAdmin.

[trimartin]

Hi
You can go to your ISA server management and see session from your BES IP
Then you can see wich username is used for that request.
This might help troubleshoot.

[pej]

I have run Websense integrated with Cisco ASAs, using the Websense ActiveDirectory-based transparent user authentication. Because the BES essentially proxies web requests for all BlackBerries, there was no way to establish an individual user's identity and apply different policies. This didn't make users with broader access to Social Media and so on very happy, especially since we forced all web traffic through the BES, but we never found a work-around.