Devices

Overview

Create and manage Local and Remote Device records and corresponding Company and People associations, as well as static Device Groups

Devices are the “target” of filter settings configured in Content Filter.

Note: for proper network operation:

Identifying Devices on the network

The DrawBridge has several ways of identifying Devices

In this chapter:

Devices Dashboard

Apps: Device Configuration

Local Devices

A Local Device record is an an entity intended to represent one Device on the local network, no matter how many network interfaces the Device has. (Exception: special IP Range devices; see FAQ below)

Devices are created by:

In the Local Device list view, select any local device record by tapping the device name or IP address link shown in the Hostname column to see an individual device record.

Record View

A Local Device record contains the following parameters:

Parameter About
Company the Company associated with the Device; see Accounts: Companies for more information
Auto Hostname the automatically-detected hostname of the device on the network, if available
Platform the operating system of the device, if specified
Type the type of hardware, such as Laptop, Smartphone, Tablet, and so forth
Status this local device record is: Active or Inactive
Source origin of the record information: auto-detected or User Entry
Last Active the timestamp of the last filter traffic recorded for this device
Reportable traffic from this device Is or Is Not included in Activity Reports

Device Record header buttons:

Informational Tabs

Device Group Membership

A local device is always part of the alldevices Device Group of the associated Company. A local device can be associated with an unlimited number of Device Groups. See the Device Groups page for further information

FAQs

Q: Why aren't Local Devices automatically appearing on my account?

A: Auto-generated Local Device records are only generated for the Main Company. Verify that your account is set as Main if you are not seeing Local Device records auto-populate.

Q: Why doesn't the Local Device record display the MAC address of my device?

A: Bogus/Randomized MAC addresses may be automatically discarded by the console to reduce the amount of auto-generated Local Device records. For more context and a resolution, see the Question "Why are there so many Local Devices listed?".

Q: Why are there so many Local Devices listed? (I only have X number of devices on my network.)

A: Several factors may result in a proliferation of Local Device records:

Q: Any type of "agent" software available for Windows computers to positively identify Local Devices on a network?

A: Yes! See the page DrawBridge Agent Reference in this chapter for further information

Q: Can I create an “entity” for an IP address range instead of making a bunch of Local Device records?

A: Yes! Create a new Local Device, and in the Platform field, select Network IP / IP Range, then enter the IP address range. This special “Local Device” can be used in a Device Group just like an ordinary Local Device or Remote Device record.

Remote Devices

A Remote Device connects through your DrawBridge from "outside" your network -- from the public Internet.

Remote Devices are created by:

In the Remote Device list view, select any remote device record by tapping the username shown in the Filter Username column to see an individual device record.

Record View

The individual Remote Device record contains the following parameters:

Parameter About
Company the Company associated with the Device; see the Accounts section for more information
Console User the Person record associated with the Remote Device
Filter Username the unique username this Device uses for authentication; this must either match or begin with the username of the associated Console User/Person
Email the email address of the associated Person record
Status this device record is: Active or Inactive
Canonical ID the global unique identifier for this Remote Device; used for synchronization
Contact CID the global unique identifier of the associated Person record; used for sychronization
Last Active the timestamp of the last filter traffic recorded for this device
Device Type the type of hardware, such as Laptop, Smartphone, Tablet, and so forth

Remote Device Record header Buttons:

Informational Tabs

Device Group Membership

A remote device is always part of the alldevices Device Group of the associated Company. A remote device can be associated with an unlimited number of Device Groups. See the Device Groups page for further information.

FAQs

Q: Why am I getting a Proxy Authentication Required popup on my mobile device?

A: Your device is not properly authenticated with the DrawBridge. Visit the User URL for your device in a browser on that device, and ensure you get a Success message.

If you continue to get these Proxy Authentication Required popups after a successful authentication event:

Q: Why does the Last Active timestamp not line up with the known usage of the Remote Device?

A: This timestamp is the last recorded filter log activity for the device. There are several possibilities to explain why a device that is known to be in-use is not showing a current corresponding timestamp:

  1. The device does not have a data connection.

    Solution:

    • Ensure the device has an active data plan and/or connect the device to an open WiFi network (not a captive-portal-controlled network, such as many public hotspots).
    • Perform activities on the device that will generate log data, such as visiting a search engine in a browser.
    • Verify while performing the activies that loglines are shown in the DrawBridge Realtime Log Viewer for the device.
    • If loglines for that device are displayed in the Realtime viewer, wait at least 15 minutes for the logs to be processed.
    • Refresh the Device Record page to see if the Last Active timestamp has been updated.

  2. The device is not properly authenticating with the DrawBridge, therefore, no web activity logs are being recorded.

    Solution:

    • Follow the same steps as detailed above to verify there are loglines displayed in the Realtime Log Viewer for the device in question.
    • If there are no loglines, and yet web resources can be accessed on the device, then the proxy software on the device is failing to properly proxy traffic.
    • Verify the proxy settings/software on the device are correctly configured.
    • Visit the device User URL in a browser on the device to trigger an authentication event while monitoring the DrawBridge Realtime Log Viewer Errors Log, with the Remote Device port entered in the Pattern field. You should see one or more lines indicating successful authentication.

    Note for Android devices: Android has a "fail-open" proxy design, so if authentication fails for any reason, Android will bypass the proxy. This can generally be resolved by re-authenticating the device with the DrawBridge.

  3. The only traffic that is getting recorded is considered "system activity" and is not considered reportable, and is therefore not saved, so the Last Activity timestamp is not updated.

    Solution: Follow the steps in #1 and #2 (if needed) to ensure the device is properly proxied and authenticating with the DrawBridge.

Q: Why do Remote Devices need to be authenticated?

A: It's critical for filtering and reporting purposes that the device that is connecting to the DrawBridge be postitively, unmistakably, identified.

Beyond that, anything connected to the internet is potentially a target for misuse. For example, if no authentication (username/password) was required for a remote device, a hacker could route their activities unimpeded through your internet connection, therefore making their malicious traffic appear to be originating with you. You may be held legally responsible for what happens on your internet connection. Depending on the type of activities, you may receive a legal notice warning of a DMCA violation. (Digital Millenium Copyright Act.) However, requiring authentication from all remote devices eliminates these concerns.

Q: How does setting Port+Platform+ExternalNetwork information assist Remote Device authentication?

A: As noted above, the DrawBridge requires authentication for Remote Devices. However, mobile operating system platforms (Android and iOS) are notorious for failing to always communicate the required credentials for authentication of each network session they establish. So, to smooth the user experience, the DrawBridge accomodates "assumed authentication" -- if a network request matches all three parameters:

... then the DrawBridge will "assume" that the request is legitimate and consider the request authenticated. This prevents repeated Proxy Authentication Required popups on mobile devices as they roam cellular networks.

Device Groups

Device Group records are entities containing one or more Devices to which Access Policies can be applied. See Content Filter: Web Page Access for further information.

In the Device Groups list view, click the drop-down arrow button to the left of a line name to display member devices and associated Access Policies.

Depending on your Console Permission Group membership, and whether multiple Companies are present on your DrawBridge, you will be able to see all the Device Groups available on the system. See Essential Concepts: Record Model - Tenancy and Hierarchy for further information.

Note: This panel only displays "static" device groups. For parameter-based "Smart Device Groups", see the Content Filter module.

SSL Certs

The DrawBridge CA certificate is required on all client devices for proper operation with the DrawBridge.

Different operating systems require different certificate types or encoding types. This menu gives you the appropriate certificate for your operating system. Click the appropriate operating system for your use case and follow the instructions to install the certificate.

Visit the SSL Certs page

If you're on a DrawBridge-protected network, visit the SSL Certs dashboard at: http://draw.bridge/sslcerts/dashboard/

If you're not on a DrawBridge-protected network, visit the SSL Certs dashboard on one of our cloud servers, such as:

Linux systems

As of this writing, a script to install the DrawBridge root CA certificate is available on all DrawBridge systems, however it is not visible in the user interface at this time.

Installation instructions:

  1. Download the installer script here: http://draw.bridge/static/software/linux_installer.zip (Note: must be on a DrawBridge-protected network with DNS resolution properly configured.)
  2. Open a terminal and navigate to the directory where you saved the script. (eg. cd ~/Downloads/)
  3. Extract the script: unzip linux_installer.zip
  4. Run the script: sudo ./Linux_Installer.sh
  5. Recommended: restart your system, or, at a minimum, your web browsers

External Networks

External Networks are used to assist with remote device authentication.

This list is managed by Compass and generally should not be edited. If you know of a new network that should be listed, please submit a support ticket to Compass (support@compassfoundation.io) to have the new External Network entry added to all DrawBridges.

DrawBridge Agent Reference

Overview

The DrawBridge Agent positively identifies and links the device it is installed on to a Local Device record in the DrawBridge. At initial install time, it will attempt auto-registration based on the device Hostname. Once the initial registration has occured, further authentication events identify the device to the DrawBridge using the registered Canonical ID (CID).

The DrawBridge Agent enables you to implement filter policies that follow a User around on your network, no matter what Device they are using, provided that the Windows User Name of the Person is known to the DrawBridge and matches a Person record present on the DrawBridge.

While this Agent was devloped primarily for companies with a Windows Active Directory server, it will also function on any local network that is protected by an onsite Drawbridge. Note that only Local Devices are supported (not Remote Devices, which presumably will be managed by a separate MDM [Mobile Device Management] service).

Notes regarding Active Directory Authentication Integration

See Accounts: Authentication Integration for more information on Active Directory server setup.

Prerequisite Network Configuration

Agent Software Installation

AgentIcon.png

DrawbridgeAgentInstallerX.X.Xexe /exenoui /qn

Operation

userswitch.png

tooltip.png

details.png

device details.png

Details

repairStart.png

This will then open another dialog where the user can confirm the repair.

repair.png

resetAgent.png

Troubleshooting

Device Registration Failed - Unable to auto-register - partial match found

Screenshot.png

In this case the local device on the console did not have the clb.local suffix so the Agent coudl not find a complete match. Upon further investigation, the local device record also had two interfaces defined, one with a MAC and IP, the other with only a MAC. Removing the interface with only the MAC address, and reinitializing the registration process fixed the problem. In summary, there will be an attempt made to match host names that only partially match local device names, but there will need to be a different definitive match found.

Check Agent logs for more details

The Agent records a log file in the C:\Program Files (x86)\Compass Foundation\DrawBridge Agent\ folder. The file name is Drawbridge Agent.log.

The DrawBridge Agent reports that device Registration failed

An important note:

Resolution: Search the Local Device list Interface column for the IP address of the device that's failing to register. Take note of the Auto-Hostname field and compare it to the actual Device hostname. These two must match for the registration to be successful.

The DrawBridge Agent local device Registration fails after domain-joining the device

If the DrawBridge Agent is deployed on a Local Device that is then joined to an AD domain at some future point, the Canonical ID for that Local Device record will then be in conflict because of the ID pulled from the Active Directory database.

Resolution: Delete the existing Local Device record; the correct Local Device record should be automatically generated at next sync.

Miscellaneous Tech Notes regarding AD Sync:

Usage Example