URL Filtering - Bypass for Level 1-2 Support

[alanglois]

Good Afternoon

I have a request to look into a way a Level 1 - 2 Support Person can easily bypass a blocked URL.  Be it by policy, a custom button on the response page, captive portal, or a combination of whatever might be needed to do so.  Has anyone set something like this up?  Is it possible?  And what would be the best practice or best method in doing so?

General Scenario:

A crticial meeting, conference, or whatever the pressing agenda would be has a user getting blocked by URL Filtering in an attempt to go to a Legitamate and Justified URL for the business need.

The User then calls Support, and without having to involve others, the Level 1 or Level 2 support person fielding the call could initiate a remote session and go through a few clicks or enter a crendetial that will temporarily allow that users session to bypass URL Filtering for that particular session or site........

I have a case opened but before I go further down that rabbit hole, I would like too see if anyone out there has done anything like this via policy, captive portal, redirect, custom button, or a combination of either to acheive this.  If it is even possible.

[Brandon_Wertz · Accepted solution]

Do you have a realworld example of a site where this has occurred?

You can use the "Overide" option in your URL profile for URL categories:

URL Admin Override

Settings for URL Admin Override

Specify the settings that are used when a page is blocked by the URL filtering profile and the Override action is specified. See “URL Filtering Profiles”. Click Add and configure the following settings for each virtual system that you want to configure for URL admin override. • Location—Select the virtual system from the drop-down list (multi-VSYS devices only). • Password/Confirm Password—Enter the password that the user must enter to override the block page.

Following this your L1/L2 tech could provide the password temporarily allowing the user to access the site.

[alanglois]

I am going to accept this solution as is, it may not be exactly what they wanted or envisioned, but it should do the job. Thanks for the assist!

[Lucky]

Hello,

you could create a scenario where specific group of GP users have URL filtering profile that only alerts without block or continue actions; upon a call to the tech support, your L1-L2 tech could enable/create a new account that would temporarily be available and given to users. Once they connect with GP, you route them through GP and apply different set of policies onto their traffic.

Just a first solution from the top of my head, would this work for you?

Regards

Luciano