Internet Filtering (Lightspeed Systems): SSL Filtering iPad Configuration … · 2017. 8. 9. ·...
Transcript of Internet Filtering (Lightspeed Systems): SSL Filtering iPad Configuration … · 2017. 8. 9. ·...
In confidence
Internet Filtering (Lightspeed Systems): SSL Filtering iPad Configuration
Reference: BTLS_LS_iOS
Version: V1.2
Date: 31 July 2017
Owner(s): Colin Helliwell
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 2 of 26
Contents Page
1 Prerequisites 5
1.1 CLEO connection 5
1.2 Operating systems 5
1.3 BTLS SSL filtering option 5
2 Manual iPad Configuration 6
2.1 Configure the IPAD to use the PAC file 6
2.2 Installing the SSL certificate 8
3 iPads configured using Lightspeed MDM 10
3.1 Identify if Lightspeed MDM is in use. 10
3.2 Configuration of PAC file. 11
3.3 Download SSL certificate 13
3.4 Installation of SSL certificate 14
4 iPads configured using Apple Configurator 17
4.1 Download SSL certificate 17
4.2 Create new profile 18
4.3 Configure the PAC file 19
4.4 Install SSL Certificate 20
5 iPads configured using Apple Configurator 2 22
5.1 Download SSL certificate 22
5.2 Create new profile 23
5.3 Configure the PAC file 24
5.4 Install SSL certificate 25
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 3 of 26
Audience: These notes are intended to be used by Schools ICT Technician, Network Manager or third party ICT support organisation.
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 4 of 26
Executive summary
Schools connected to the CLEO network may wish to enable SSL filtering as part of the Internet -
Filtering (Lightspeed Systems) service. This document details instructions designed to assist schools
in the deployment of changes required to enable this service for Apple devices running the iOS
operating system like iPads and iPhones. Following the execution of these instructions, schools will
be able to use their Lightspeed admin console reports (at https://filter.education.btlsl.co.uk) to view
the contents of secure searches run on iOS devices. Additionally Google and Bing search results will
reflect your schools filtering policy.
These notes cover the steps needed to prepare your iOS devices for the Lightspeed Secure Search
filtering option.
This must not be run in a school which is not connected to the CLEO network.
This document is for Apple iOS devices only. Please see the BT Lancashire Services website support
pages enabling SSL filtering on other types of device.
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 5 of 26
1 Prerequisites
1.1 CLEO connection
These instructions should only be run on devices connected to the CLEO network. If your school obtains it's internet access from another provider, do not follow these notes.
1.2 Operating systems
These notes have been tested working with the following operating systems: iOS 7 iOS 8 iOS 9 iOS 10 If you are using Apple Configurator to make these changes you must have configurator installed on a suitable Apple computer
1.3 BTLS SSL filtering option
These notes relate to the secure search filtering option. This enables searches to common search
engines (Google/Bing/YouTube) to be decrypted when a secure search is conducted (a secure search
will begin with https:// rather than http://). As these searches can be decrypted, schools can use the
Lightspeed reporting functions to see what their students and staff have been searching for, and have
their school policies applied. This script can be run either before or after having this service enabled
for the school, but it cannot be tested successfully until the service has been enabled.
All other search engines will be disabled as part of this change.
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 6 of 26
2 Manual iPad Configuration
2.1 Configure the IPAD to use the PAC file
Select 'Settings'
Select 'Wi-Fi' from the left hand menu. The network you're connected to will have a blue tick to the left of the network name. Tap on the letter i inside a blue circle to the right of the network you're connected to.
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 7 of 26
Select 'Auto' underneath the heading 'HTTP PROXY' and enter the PAC file location into the URL box. The PAC file location is: http://pac.education.btlsl.co.uk/cleo.pac The PAC file will need to be applied to every Wi-Fi network that requires SSL filtering. PAC file changes can only be made whilst connected to the Wi-Fi network you wish to make changes to.
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 8 of 26
2.2 Installing the SSL certificate
On the iPad open Safari and navigate to the following website: https://filter.education.btlsl.co.uk/lsaccess/proxycerthelp Select 'Download Certificate'
Select 'Install'
On the warning screen select 'Install'
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 9 of 26
Select 'Install'
Select 'Done'
The certificate is now installed.
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 10 of 26
3 iPads configured using Lightspeed MDM
3.1 Identify if Lightspeed MDM is in use.
The instructions below will identify if iOS devices are being managed by Lightspeed MDM. If Lightspeed MDM is managing your schools devices then please follow the rest of the instructions in this section for how to configure Lightspeed MDM for use with SSL filtering. If another MDM solution is being used then please use the same PAC file location and SSL certificate as detailed below but for details on how to deploy them please refer to the instructions given by your chosen MDM provider. Select 'Settings'
Select 'General' from the left hand menu then select 'Profiles & Device Management'
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 11 of 26
If a Lightspeed MDM Profile is shown as below then continue following rest of this section for details on how to configure your iOS devices with Lightspeed MDM. If you do not see this your device is not configured for MDM please enrol your device in MDM.
3.2 Configuration of PAC file.
Log in to Lightspeed MDM with your Lightspeed administrator account using the following URL: https://lsmdm.com
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 12 of 26
The PAC file needs to be configured at the top level to ensure it is inherited by all devices assigned to MDM. From within the 'Policies' section select 'Global Proxy'.
Enter the following PAC file URL; http://pac.education.btlsl.co.uk/cleo.pac The setting 'Bypass proxy if PAC unreachable' is switched on by default, please ensure this is left on otherwise the devices won't be able to access the internet when not connected to a CLEO network. Click save
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 13 of 26
3.3 Download SSL certificate
Browse to the following web site on the machine you are managing MDM from: https://filter.education.btlsl.co.uk/lsaccess/proxycerthelp The instructions for the operating system used by this device will be displayed, select 'Download Certificate' and save the certificate to your computers desktop. (Note: The certificate file itself is the same for all operating systems, the website just displays different instructions for step two onwards - which you don't need to follow.)
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 14 of 26
3.4 Installation of SSL certificate
Log in to Lightspeed MDM with your administrator account. The certificate needs to be added at the top level of the school hierarchy to ensure it is inherited by all devices assigned to MDM. From within the 'Policies' section select 'Certificates'.
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 15 of 26
Select 'Add New'
Select 'Select Certificate'
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 16 of 26
Select 'Upload'
Click on the word 'browse' to open a dialogue box then browse to the desktop where the downloaded certificate was saved to in step 2.2 above, double click the certificate then click 'Add'
Once the certificate has been added select 'Save'. Lightspeed MDM is now configured for SSL filtering.
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 17 of 26
4 iPads configured using Apple Configurator
4.1 Download SSL certificate
Browse to the following web site and select 'Download Certificate' https://filter.education.btlsl.co.uk/lsaccess/proxycerthelp
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 18 of 26
4.2 Create new profile
Open Apple Configurator, select '+' then 'Create New Profile'
Select 'General' and name the profile accordingly.
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 19 of 26
4.3 Configure the PAC file
Select 'Global HTTP Proxy' from the left hand menu then select 'Configure'
From the 'Proxy Type' drop down box select 'Auto'
Enter http://pac.education.btlsl.co.uk/cleo.pac into the 'Proxy PAC URL' field
Check the box for 'Allow direct connection if PAC is unreachable'
Please note: Ensure the 'Allow direct connection if PAC is unreachable' is checked, if this isn't checked then devices won't be able to access the internet when not connected to the CLEO network.
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 20 of 26
4.4 Install SSL Certificate
From the left hand menu scroll down and select 'Certificates' then select 'Configure'
Browse to the location where the certificate was saved to by default this would be the 'Downloads'
folder, select the certificate then select 'Open'
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 21 of 26
To complete the profile select 'Save'
The profile is now ready to be applied to iPads using Apple Configurator.
Please note:
If the certificate hasn't been installed on the Apple Mac then it will show that the certificate isn't
trusted as per the screenshot below. For details on how to install the certificate please see BTLS
instructions that cover the OSX operating system.
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 22 of 26
5 iPads configured using Apple Configurator 2
5.1 Download SSL certificate
Browse to the following web site and select 'Download Certificate' https://filter.education.btlsl.co.uk/lsaccess/proxycerthelp
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 23 of 26
5.2 Create new profile
Open Apple Configurator, select 'File' then 'New Profile'
Select 'General' from the left hand menu and name the profile accordingly.
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 24 of 26
5.3 Configure the PAC file
Select 'Global HTTP Proxy' from the left hand menu then select 'Configure'
From the 'Proxy Type' drop down box select 'Auto' Enter http://pac.education.btlsl.co.uk/cleo.pac into the 'Proxy PAC URL' field Check the box 'Allow direct connection if PAC is unreachable'
Please note:
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 25 of 26
Ensure the 'Allow direct connection if PAC is unreachable' is checked, if this isn't checked then devices won't be able to access the internet when not connected to the CLEO network.
5.4 Install SSL certificate
From the left hand menu scroll down and select 'Certificates' then select 'Configure'
Browse to the location where the certificate was saved to by default this would be the 'Downloads' folder, select the certificate then select 'Open'
BT Lancashire Services Education Services SSL Filtering
iPad Configuration
Version 1.2 July 2017
Page 26 of 26
To complete the profile select 'File' then 'Save' and save to your chosen location.
The profile is now ready to be applied to iPads using Apple Configurator 2.