Using WebMarshal with kiosk computers, smartphones and tablets with IP Authentication

This article applies to:

• WebMarshal 6.X and 7.X

Question:

• How can I set up Kiosk Computers, iPads and other mobile devices to use WebMarshal as the proxy? 

Reply:

WebMarshal IP Authentication can be used to log and control web activity where the user does not have a network credential, or the device does not understand proxy authentication. 

IP Address authentication is transparent to the end user. WebMarshal will use the IP Address of the connecting device/computer and will apply policy based on the address. You can apply any WebMarshal rule based on IP address.

Procedure:

To configure and enable IP Address based authentication:

1. The browser or other application on the Kiosk computer or mobile device must understand the concept of using a "web proxy" (it must have the relevant settings to configure which proxy and port to use). The application must be able to connect to WebMarshal using the configured web proxy settings, at the network connection level.
2. WebMarshal must accept IP based authentication. By default WebMarshal accepts IP based authentication on port 8081. To customize this setting, in the WebMarshal Console navigate to Tools > Global Settings > Proxy Settings > Ports and Authentication. 

   • Before changing the port, check that no other software is listening on the new port. See article Q12072.

   
   
3. WebMarshal must be configured with IP Address user groups that include the IP addresses you want to allow. To add an IP address group:
   • In the WebMarshal Console, click User Groups.
   • From the Action menu or the right pane menu bar, choose “New IP Address Group”.
   • Enter a name and optionally a description.
   • Enter a starting and ending IP address for the range.
     
     Note: WebMarshal adds the name or IP address of each computer in this range to the All Users list the first time that computer connects to WebMarshal. Once the computer names are included in the list, you can use them individually within Rules in the same way as any other User.
4. Configure the web browser or application software to use your WebMarshal proxy server and the port specified in step 2.
   
   • To specify these settings in Internet Explorer on a client computer, open Tools > Internet options > Connections > LAN Settings.
• For other browsers and applications, please refer to the application's support documentation for configuring proxy settings. Many applications allow you to set a custom proxy that is different from the configuration of IE or other browsers.
  
  • As an example, in MailMarshal SEG you can configure this setting in the Configurator, Tools > MailMarshal Properties > Internet Access (and optionally in the Server Properties for each processing node).
5. After configuring proxy settings, browse to http://webmarshal.home
   • The result should be a pages showing the name or IP address of your computer and other details regarding your WebMarshal proxy server.
   • Any user or process on a computer with an IP address in the specified range (as in step 3) can browse through WebMarshal, subject to any rules you choose to apply on this IP Address group.
6. The recommended way to apply policy to an IP Address group is to add it to one of the standard groups created by default with WebMarshal (Power Users, Standard Users, Restricted Users). This approach is versatile and flexible as the application of the rules will remain the same regardless of any new users, computers or groups added or removed from a WebMarshal user group.
   • It is best practice to NOT use any imported groups directly in policy.

Notes:

• For more information on creating and managing WebMarshal groups and modifying your policy accordingly, please refer to the WebMarshal User Guide and help.
• If you use IP authentication in an environment that assigns IP addresses dynamically (using DHCP), please note the following limitations:
  • The IP address of a device could change.
  • To ensure that IP based rules apply as expected in a DHCP environment, you should not set up special rules for individual device names or addresses.
  • Where devices have resolvable names (for instance in a Windows domain environment), WebMarshal attempts to resolve the name and applies rules to devices by name if possible. This feature is designed to assist with policy and reporting if the IP address changes. However tracking by name is generally not possible for mobile devices, or if name resolution is not available.
  • When WebMarshal cannot resolve a device name, it applies policy using the current IP address of the device.