Internet Filtering (Lightspeed Systems): SSL Filtering iPad Configuration … · 2017. 8. 9. ·...

In confidence

Internet Filtering (Lightspeed Systems): SSL Filtering iPad Configuration

Reference: BTLS_LS_iOS

Version: V1.2

Date: 31 July 2017

Owner(s): Colin Helliwell

BT Lancashire Services Education Services SSL Filtering

iPad Configuration

Version 1.2 July 2017

of 26

Contents Page

1 Prerequisites 5

1.1 CLEO connection 5

1.2 Operating systems 5

1.3 BTLS SSL filtering option 5

2 Manual iPad Configuration 6

2.1 Configure the IPAD to use the PAC file 6

2.2 Installing the SSL certificate 8

3 iPads configured using Lightspeed MDM 10

3.1 Identify if Lightspeed MDM is in use. 10

3.2 Configuration of PAC file. 11

3.3 Download SSL certificate 13

3.4 Installation of SSL certificate 14

4 iPads configured using Apple Configurator 17


4.2 Create new profile 18

4.3 Configure the PAC file 19

4.4 Install SSL Certificate 20

5 iPads configured using Apple Configurator 2 22


5.2 Create new profile 23

5.3 Configure the PAC file 24

5.4 Install SSL certificate 25


iPad Configuration


of 26

Audience: These notes are intended to be used by Schools ICT Technician, Network Manager or third party ICT support organisation.


iPad Configuration


of 26

Executive summary

Schools connected to the CLEO network may wish to enable SSL filtering as part of the Internet -

Filtering (Lightspeed Systems) service. This document details instructions designed to assist schools

in the deployment of changes required to enable this service for Apple devices running the iOS

operating system like iPads and iPhones. Following the execution of these instructions, schools will

be able to use their Lightspeed admin console reports (at https://filter.education.btlsl.co.uk) to view

the contents of secure searches run on iOS devices. Additionally Google and Bing search results will

reflect your schools filtering policy.

These notes cover the steps needed to prepare your iOS devices for the Lightspeed Secure Search

filtering option.

This must not be run in a school which is not connected to the CLEO network.

This document is for Apple iOS devices only. Please see the BT Lancashire Services website support

pages enabling SSL filtering on other types of device.

https://filter.education.btlsl.co.uk/


iPad Configuration


of 26

1 Prerequisites

1.1 CLEO connection

These instructions should only be run on devices connected to the CLEO network. If your school obtains it's internet access from another provider, do not follow these notes.

1.2 Operating systems

These notes have been tested working with the following operating systems: iOS 7 iOS 8 iOS 9 iOS 10 If you are using Apple Configurator to make these changes you must have configurator installed on a suitable Apple computer

1.3 BTLS SSL filtering option

These notes relate to the secure search filtering option. This enables searches to common search

engines (Google/Bing/YouTube) to be decrypted when a secure search is conducted (a secure search

will begin with https:// rather than http://). As these searches can be decrypted, schools can use the

Lightspeed reporting functions to see what their students and staff have been searching for, and have

their school policies applied. This script can be run either before or after having this service enabled

for the school, but it cannot be tested successfully until the service has been enabled.

All other search engines will be disabled as part of this change.


iPad Configuration


of 26

2 Manual iPad Configuration

2.1 Configure the IPAD to use the PAC file

Select 'Settings'

Select 'Wi-Fi' from the left hand menu. The network you're connected to will have a blue tick to the left of the network name. Tap on the letter i inside a blue circle to the right of the network you're connected to.


iPad Configuration


of 26

Select 'Auto' underneath the heading 'HTTP PROXY' and enter the PAC file location into the URL box. The PAC file location is: http://pac.education.btlsl.co.uk/cleo.pac The PAC file will need to be applied to every Wi-Fi network that requires SSL filtering. PAC file changes can only be made whilst connected to the Wi-Fi network you wish to make changes to.

http://pac.education.btlsl.co.uk/


iPad Configuration


of 26

2.2 Installing the SSL certificate

On the iPad open Safari and navigate to the following website: https://filter.education.btlsl.co.uk/lsaccess/proxycerthelp Select 'Download Certificate'

Select 'Install'

On the warning screen select 'Install'

https://filter.education.btlsl.co.uk/lsaccess/proxycerthelp


iPad Configuration


of 26

Select 'Install'

Select 'Done'

The certificate is now installed.


iPad Configuration


of 26

3 iPads configured using Lightspeed MDM

3.1 Identify if Lightspeed MDM is in use.

The instructions below will identify if iOS devices are being managed by Lightspeed MDM. If Lightspeed MDM is managing your schools devices then please follow the rest of the instructions in this section for how to configure Lightspeed MDM for use with SSL filtering. If another MDM solution is being used then please use the same PAC file location and SSL certificate as detailed below but for details on how to deploy them please refer to the instructions given by your chosen MDM provider. Select 'Settings'

Select 'General' from the left hand menu then select 'Profiles & Device Management'


iPad Configuration


of 26

If a Lightspeed MDM Profile is shown as below then continue following rest of this section for details on how to configure your iOS devices with Lightspeed MDM. If you do not see this your device is not configured for MDM please enrol your device in MDM.

3.2 Configuration of PAC file.

Log in to Lightspeed MDM with your Lightspeed administrator account using the following URL: https://lsmdm.com

https://lsmdm.com/


iPad Configuration


of 26

The PAC file needs to be configured at the top level to ensure it is inherited by all devices assigned to MDM. From within the 'Policies' section select 'Global Proxy'.

Enter the following PAC file URL; http://pac.education.btlsl.co.uk/cleo.pac The setting 'Bypass proxy if PAC unreachable' is switched on by default, please ensure this is left on otherwise the devices won't be able to access the internet when not connected to a CLEO network. Click save



iPad Configuration


of 26

3.3 Download SSL certificate

Browse to the following web site on the machine you are managing MDM from: https://filter.education.btlsl.co.uk/lsaccess/proxycerthelp The instructions for the operating system used by this device will be displayed, select 'Download Certificate' and save the certificate to your computers desktop. (Note: The certificate file itself is the same for all operating systems, the website just displays different instructions for step two onwards - which you don't need to follow.)



iPad Configuration


of 26

3.4 Installation of SSL certificate

Log in to Lightspeed MDM with your administrator account. The certificate needs to be added at the top level of the school hierarchy to ensure it is inherited by all devices assigned to MDM. From within the 'Policies' section select 'Certificates'.


iPad Configuration


of 26

Select 'Add New'

Select 'Select Certificate'


iPad Configuration


of 26

Select 'Upload'

Click on the word 'browse' to open a dialogue box then browse to the desktop where the downloaded certificate was saved to in step 2.2 above, double click the certificate then click 'Add'

Once the certificate has been added select 'Save'. Lightspeed MDM is now configured for SSL filtering.


iPad Configuration


of 26

4 iPads configured using Apple Configurator


Browse to the following web site and select 'Download Certificate' https://filter.education.btlsl.co.uk/lsaccess/proxycerthelp



iPad Configuration


of 26

4.2 Create new profile

Open Apple Configurator, select '+' then 'Create New Profile'

Select 'General' and name the profile accordingly.


iPad Configuration


of 26

4.3 Configure the PAC file

Select 'Global HTTP Proxy' from the left hand menu then select 'Configure'

From the 'Proxy Type' drop down box select 'Auto'

Enter http://pac.education.btlsl.co.uk/cleo.pac into the 'Proxy PAC URL' field

Check the box for 'Allow direct connection if PAC is unreachable'

Please note: Ensure the 'Allow direct connection if PAC is unreachable' is checked, if this isn't checked then devices won't be able to access the internet when not connected to the CLEO network.



iPad Configuration


of 26

4.4 Install SSL Certificate

From the left hand menu scroll down and select 'Certificates' then select 'Configure'

Browse to the location where the certificate was saved to by default this would be the 'Downloads'

folder, select the certificate then select 'Open'


iPad Configuration


of 26

To complete the profile select 'Save'

The profile is now ready to be applied to iPads using Apple Configurator.

Please note:

If the certificate hasn't been installed on the Apple Mac then it will show that the certificate isn't

trusted as per the screenshot below. For details on how to install the certificate please see BTLS

instructions that cover the OSX operating system.


iPad Configuration


of 26

5 iPads configured using Apple Configurator 2


Browse to the following web site and select 'Download Certificate' https://filter.education.btlsl.co.uk/lsaccess/proxycerthelp



iPad Configuration


of 26

5.2 Create new profile

Open Apple Configurator, select 'File' then 'New Profile'

Select 'General' from the left hand menu and name the profile accordingly.


iPad Configuration


of 26

5.3 Configure the PAC file

Select 'Global HTTP Proxy' from the left hand menu then select 'Configure'

From the 'Proxy Type' drop down box select 'Auto' Enter http://pac.education.btlsl.co.uk/cleo.pac into the 'Proxy PAC URL' field Check the box 'Allow direct connection if PAC is unreachable'

Please note:



iPad Configuration


of 26

Ensure the 'Allow direct connection if PAC is unreachable' is checked, if this isn't checked then devices won't be able to access the internet when not connected to the CLEO network.

5.4 Install SSL certificate

From the left hand menu scroll down and select 'Certificates' then select 'Configure'

Browse to the location where the certificate was saved to by default this would be the 'Downloads' folder, select the certificate then select 'Open'


iPad Configuration


of 26

To complete the profile select 'File' then 'Save' and save to your chosen location.

The profile is now ready to be applied to iPads using Apple Configurator 2.

Internet Filtering (Lightspeed Systems): SSL Filtering iPad Configuration … · 2017. 8. 9. ·...

Documents

Transcript of Internet Filtering (Lightspeed Systems): SSL Filtering iPad Configuration … · 2017. 8. 9. ·...