User not filtered properly

This article applies to:

• Web Filter

Question:

• Requests from a user are not being filtered as expected. What are the steps to troubleshoot this situation?

Procedure:

Run an active profile lookup on the IP that is not being filtered properly and note what Group they are currently being filtered under.

Groups:

Is the user in the expected group?

1. If the user EXISTS in the expected group:
   • On the ruleset in the active profile lookup, confirm that the site in question is set to the appropriate level:
     • Block: Site will be blocked unless an allow exists which will take precedence.
     • Allow: Should always take precedence.
     • Pass: Does nothing other than allows the traffic to pass. If the site is in multiple categories and one is set to block, the site would then be blocked.
2. If the user IS NOT in the expected group:

LDAP:

3. Is the user being filtered via LDAP?
   • If so, confirm that the system in question has the authenticat program running.
   • You can check by looking in the windows Task Manager and searching for an instance of Authenticat.
   • You can also check (if installed via a service) if the program is running as a service.
     • Run services.msc (windows key + R) and search for the M86 Authenticator service
   • Are multiple instances of the M86 authenticator running? Multiple instances can cause inconsistent filtering results, because all instances will attempt to bind to the same port, but only one instance can bind at a time.
     • Multiple instances can be caused by GPO or batch files.
4. Is the Domain marked as inactive?
   • If the domain was recently rebooted, you may need to re-activate the domain.
   • If you experience errors when attempting to activate the domain, contact Trustwave TAC.