Lightspeed Mobile Filter for IOS

The mobile filter for iOS mirrors the function of the mobile filter for OSX, which means it only works outside of your network. I've heard that there are ways to muck with Lightspeed to get the mobile filter to work inside your network, but I've also heard that it's not worth the headache.

I played with it at our school.

It was a mess to get working. I think I had to deploy the app first, then when it detected that the iPads had the app, then I could push the configuration profile to configure the app. And even then sometimes it wasn't working. It was just a straight up mess. Their support had no idea how to help. Seriously, I taught them things it seemed.

We're testing Mobicip now, which is actually working great and was easy to configure.

I want to second @bburdeaux. We have it working but it's only working off campus. It works very effectively off-campus though. Make it work on campus it would take the restructuring that @bburdeaux described. In short for on campus what we do is rely on default policy . Staff members can go to a designated website and elevate their privileges if need be. For it to work though, app + profile must always be present on device to function. What we do is throw a profile blocking Safari if the light speed app isn't present. Again, great off campus but lightspeed would have to help you to make MobileFilter work on campus.

Brian, can you tell me how you have the app and profile configured? I'm configured them per Lightspeed's instructions but they aren't working for me? Also, are you using it in conjunction with the global proxy? Their documentation implies it won't work with the proxy but the tech I'm currently working with is telling me it will work with the proxy and you need to have it enabled is you want to do off site SSL decryption. Thanks.

@jdemuth I have an answer for you but as the details get more fine-grain, I need to make sure I am communicating directly to you somehow as I do not want to reveal our filtering system in great detail for our end users.

Please give me a verifiable way that you are IT personnel with a direct means of contact. You can appreciate why as I want to help provide more details of how we did this. Details available with a direct means of contact.

Brian, sorry for the delay. You can contact me a netadmin@dce.k12.wi.us.

Can anyone offer any insight on this? What is everyone that got it working putting in the Filter Name and Identifier fields? I seem to be able to get every site "restricted" (not by a Lightspeed page), or no sites filtered at all.

Kempt,

I have been going through a new deployment at our school. I will provide what we have been doing as far as settings configuration below just plug in your appropriate info. Also ensure that the Mobile Filter iOS app is installed through the MDM as a managed app and has been opened once on the device being filtered. If the configuration profile is installed, you will see your organization name, unique ID, filter address, and app version when the app is opened.

This was extremely helpful, thanks!

@ItsRomo Do you have anyway I can reach out to you offline...I know you don't want to broadcast your info out to the world and I can respect that. I am running into some specific issues with Lightspeed that I want to ask you your experiences about and brainstorm. I promise to keep a conversation brief.

I'm trying to look you up online and am hitting a brick wall. Would you be willing to either let me know who you work for or give me some way that I could get a hold of you?

I thank you in advance, If you like I work for the Lafayette School Corporation in Lafayette IN. My phone contact info can be found on our web site.

@blackholemac I've recently gotten this working at The Westminster Schools in Atlanta if you still had questions about this..

We use Lightspeed Web/Mobile Filtering 3.0 with on-premise appliances

Is anyone willing to work off line with me? We need to get this up ASAP for a 1-to-1 iPad pilot program. I had questions regarding internal access to the filter

Has anyone worked with their new Relay app? It wants the username and the UUID as variables in the config profile.

@chris.miller

I have and when I get back to the office I will provide some info.

@chris.miller

For our iPads I have performed the following:
- Created a configuration Profile

General:
-- Name: CPA-MS-2025-Proxy

Certificate:
-- Downloaded Certificate from Rocket and place here

Global HTTP Proxy:
- Proxy Type: Automatic
-- Proxy PAC URL: (Your Proxy PAC URL here)
-- Allow Direct connection if PAC is unreachable = checked

Content Filter:
-- Filter Type: Plug-in
Filter Name: Whatever you want the name to be

-- Identifier: com.lightspeedsystems.iosmobilefilter

-- Service Address: Your hostname or IP Address of your Rocket

-- Organization: Name of Orginization

-- User Name: domain$USERNAME

Custom Data
key: value:
customerID (I found this information in the device registration portal, http://mobile.lsfilter.com/ )

Note: For the USERNAME to function properly you will need to populate the username filed on the device under User and Location.

Once the app is installed you will need to launch it for it to fetch the settings and register in the device registration portal.

I hope this helps.

We are also working with Lightspeed Support to get our config profile setup properly and are running into some challenges with it not being properly formatted. Would anyone be willing to send along their profile so we can use it as a template?

Thanks!

@rsaeks I think it's different if you have an appliance vs. using Relay, the cloud-based solution. We're using the later and I had a hell of a time because their documentation is quite frankly garbage, but after a call to support they let us know that a $ is the wildcard character needed for jamf. So I set up the Content Filter payload as follows and everything worked:

FILTER TYPE: Plug-in

FILTER NAME: Lightspeed Relay
IDENTIFIER: com.lightspeedsystems.iosrelayfilter
SERVICE ADDRESS: (left blank) ORGANIZATION: (your organization - can be whatever you want)
USER NAME: $EMAIL PASSWORD: (left blank)
VERIFY PASSWORD: (left blank)
CERTIFICATE: None

Filter WebKit Traffic - check
Filter Socket Traffic - check

Custom Data
KEY VALUE
customerID (your customer ID - lightspeed provides) UDID $UDID

With all of that being said, we were pitched something that isn't currently possible. The sales rep that we spoke with promised that we could filter iPads like you can filter Chromebooks, but in actuality most features are still in the works. We were told we'd need to get an appliance to do what we want to do. Hope you have good luck with them!

I'm using $NAME for the USER NAME: variable and it seems to be working. Has anyone come up with a good way to prevent students from simply deleting the Relay app?

@chris.miller

Under restrictions, we have unchecked "Allow removing apps (supervised only)". We do push the apps and if we don't we put them in Self Service and they can download them as needed.

I hope this helps.

So we have run into a lot of these same issues, and today we saw that the wildcard identifier of $EMAIL returned an error in the Config file. We previously used $USERNAME but we were told this will not allow the tracing data to populate correctly. We also had to disable app deletion. Has anyone managed to get the website history and data tracking on a per user basis?

I am going to try this as Mobicip does not work. We loaded their product via a Global Proxy in August and it has never worked correctly. It makes Self Service not load and even prevents Safari from loading. I have reached out to their support dozens of times and get little or no response.

We went through the hassle for the last 2 weeks and have it functional. The reporting side anyway. Filtering appears to work but seems to default to over filtering on some devices , which is obviously preferred but an annoyance.

Our issue was in regards to using the $EMAIL wildcard and populating the email field of the user info. This paired up the data successfully.

and as @thejenbot stated, we were told we would have features that are not yet enabled.