Preparing for installation

Deployment and Installation Center | Web, Data, and Email Security Solutions | Version 7.7.x

Applies to:

In this topic

Web Filter, Web Security, Web Security Gateway, and Web Security Gateway Anywhere, v7.7.x

Data Security, v7.7.x

Email Security Gateway and Gateway Anywhere, v7.7.x

V-Series Appliances, v7.7.x

All Websense security solutions

TRITON Unified Security Center

Web security

Data Security

All Websense security solutions

Before installing any Websense security solution, make a note of the following:

Windows-specific considerations

Make sure all Microsoft updates have been applied. There should be no pending updates, especially any requiring a restart of the system.

In addition to the space required by the Websense installer itself, further disk space is required on the Windows installation drive (typically C) to accommodate temporary files extracted as part of the installation process.

For information on minimum disk space requirements, see Hardware requirements.

NET Framework version 2.0 or higher is required to run the Windows installer. If .NET 2.0 is not already installed, it is available from www.microsoft.com.


	Note Both .NET Framework 2.0 and 3.5 SP1 are required if you are installing SQL Server Express.

Getting the Websense software installers

The Websense Windows installer is used to install TRITON Unified Security Center; Web Security, Data Security, and Email Security components; and SQL Server 2008 R2 Express.

There are also Linux installers for installing Web Security components and Content Gateway.

The installers are also used to upgrade most prior-version components.

Download the installers from mywebsense.com.

The Windows installer is named WebsenseTRITON77Setup.exe. Double-click it to start the installation process.

If you have previously run the Websense installer on a machine, and you selected the Keep installation files option, go to Start > All Programs > Websense > Websense TRITON Setup to restart the installer without extracting all of the files a second time.

Note that the files occupy approximately 2 GB of disk space.

The Web Security Linux installer is WebsenseWeb77Setup_Lnx.tar.gz.

The Content Gateway installer is WebsenseCG77_Lnx.tar.gz.

Domain Admin privileges

Websense components are typically distributed across multiple machines. Additionally, some components access network directory services or database servers. To install Websense components, it is a best practice to log in to the machine as a user with domain admin privileges. Otherwise, components may not be able to properly access remote components or services.


	Important If you plan to install SQL Server 2008 R2 Express and will use it to store and maintain Web Security data, you must log in as a domain user when installing it (i.e., log in to the machine as a domain user prior to running the Websense installer).

Synchronizing clocks

If you are distributing Websense components across different machines in your network, synchronize the clocks on all machines where a Websense component is installed. It is a good practice to point the machines to the same Network Time Protocol server.


	Note If you are installing components that will work with a Websense V-Series appliance, you must synchronize the machine's system time to the appliance's system time.

Antivirus

Disable any antivirus on the machine prior to installing Websense components. Be sure to re-enable antivirus after installation. Certain Websense files should be excluded from antivirus scans to avoid performance issues; see Excluding Websense files from antivirus scans.

No underscores in FQDN

For best practices, do not install Websense components on a machine whose fully-qualified domain name (FQDN) contains an underscore.

The use of an underscore character in an FQDN is not a supported Internet Engineering Task Force (IETF) standard, an official Internet standard, that Websense complies with.


	Note Further details of this limitation can be found in the IETF specifications RFC-952 and RFC-1123.

TRITON Unified Security Center

In addition to the general preparation actions (see All Websense security solutions), before installing the TRITON Unified Security Center, note the following:

Do not install the TRITON Unified Security Center on a domain controller machine.

If you want to run Microsoft SQL Server on the TRITON management server, use the Websense installer to install SQL Server 2008 R2 Express.

If you are using a remote installation of SQL Server, you can use any of the supported versions (see System requirements for this version).

SQL Server 2008 R2 Express

The following third-party components are required to install Microsoft SQL Server 2008 R2 Express. Although the Websense installer will install these components automatically if they are not found, it is a best practice to install the components first, before running the Websense installer.

.NET Framework 3.5 SP1


	Note Because the installer requires .NET 2.0, both .NET 2.0 and 3.5 SP1 are required if you are installing SQL Server Express.

Windows Installer 4.5

Windows PowerShell 1.0

PowerShell is available from Microsoft (www.microsoft.com).

If you will use SQL Server 2008 R2 Express to store and maintain Web Security data, you must log in to the machine as a domain user to run the Websense installer. Service Broker, which is installed as part of SQL Server 2008 R2 Express, must be able to authenticate itself against a domain. Logging in as a domain user when running the installer makes sure Service Broker is installed to run as the domain user.

Web security

In addition to the general preparation actions (see All Websense security solutions), see the following if you will be installing Web Filter, Web Security, Web Security Gateway, or Web Security Gateway Anywhere components.

Filtering Service Internet access

To download the Websense Master Database and enable filtering, each machine running Websense Filtering Service must be able to access the download servers at:

download.websense.com

Make sure that these addresses are permitted by all firewalls, proxy servers, routers, or host files that control the URLs that Filtering Service can access.

Firewall

Disable any firewall on the machine prior to installing Websense components. Be sure to disable it before starting the Websense installer and then re-enable it after installation. Open ports as required by the Websense components you have installed.


	Note The Websense installer adds two inbound rules to the public profile of Windows Firewall. Ports 9443 and 19448 are opened for TRITON Infrastructure. These ports must be open to allow browsers to connect to the TRITON Unified Security Center. Also, additional rules may be added to Windows Firewall when installing Websense Data Security components.

See Websense TRITON Enterprise default ports for more information about ports used by Websense components.

Computer Browser Service (Windows Server 2008)

To install Websense software on a Windows Server 2008 machine, the Computer Browser Service must be running (note: on most machines you will find it disabled by default).

Network Agent

If you are installing Network Agent, ensure that the Network Agent machine is positioned to be able to monitor and respond to client Internet requests.

In standalone installations (which do not include Content Gateway or a third-party integration product), if you install Network Agent on a machine that cannot monitor client requests, basic HTTP filtering and features such as protocol management and Bandwidth Optimizer cannot work properly.


	Important Do not install Network Agent on a machine running a firewall. Network Agent uses packet capturing that may conflict with the firewall software.

The network interface card (NIC) that you designate for use by Network Agent during installation must support promiscuous mode. Promiscuous mode allows a NIC to listen to IP addresses other than its own. If the NIC supports promiscuous mode, it is set to that mode by the Websense installer during installation. Contact your network administrator or the manufacturer of your NIC to see if the card supports promiscuous mode.

On Linux, do not choose a NIC without an IP address (stealth mode) for Network Agent communications.


	Note If you install Network Agent on a machine with multiple NICs, after installation you can configure Network Agent to use more than one NIC. See the "Network Configuration" topic in the TRITON - Web Security Help for more information.

Network Agent using multiple NICs on Linux

If Network Agent is installed on a Linux machine, using one network interface card (NIC) for blocking and another NIC for monitoring, make sure that either:

The blocking NIC and monitoring NIC have IP addresses in different network segments (subnets).

You delete the routing table entry for the monitoring NIC.

If both the blocking and monitoring NIC on a Linux machine are assigned to the same subnet, the Linux operating system may attempt to send the block via the monitoring NIC. If this happens, the requested page or protocol is not blocked, and the user is able to access the site.

Installing on Linux

Most Web Security components can be installed on Linux. If you are installing on Linux complete the instructions below.

SELinux

Before installing, if SELinux is enabled, disable it or set it to permissive.

Linux firewall

If Websense software is being installed on a Linux machine on which a firewall is active, shut down the firewall before running the installation.

Open a command prompt.

Enter service iptables status to determine if the firewall is running.

If the firewall is running, enter service iptables stop.

After installation, restart the firewall. In the firewall, be sure to open the ports used by Websense components installed on this machine. See Websense TRITON Enterprise default ports.


	Important Do not install Websense Network Agent on a machine running a firewall. Network Agent uses packet capturing that may conflict with the firewall software. See Network Agent.

Hostname

Before installing to a Linux machine, make sure the hosts file (by default, in /etc) contains a hostname entry for the machine, in addition to the loopback address. (Note: you can check whether a hostname has been specified in the hosts file by using the hostname -f command.)

To configure hostname:

Set the hostname:

hostname <host>

Here, <host> is the name you are assigning this machine.

Also update the HOSTNAME entry in the /etc/sysconfig/network file:

HOSTNAME=<host>

In the /etc/hosts file, specify the IP address to associate with the hostname. This should be static, and not served by DHCP. Do not delete the second line in the file, the one that begins with 127.0.0.1 (the IPv4 loopback address). And do not delete the third line in the file, the on that begins ::1 (the IPv6 loopback address).

<IP address> <FQDN> <host>
127.0.0.1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6

Here, <FQDN> is the fully-qualified domain name of this machine (i.e., <host>.<subdomains>.<top-level domain>)—for example, myhost.example.com—and <host> is the name assigned to the machine.


	Important The hostname entry you create in the hosts file must be the first entry in the file.

TCP/IP only

Websense software supports only TCP/IP-based networks. If your network uses both TCP/IP- and non-IP-based network protocols, only users in the TCP/IP portion of the network are filtered.

Data Security

See below for information about preparing to install Data Security components.

Do not install Data Security Server on a DC

Do not install Data Security Server on a domain controller (DC) machine.

Domain considerations

The servers running the Data Security software can be set as part of a domain or as a separate workgroup. If you have multiple servers or want to perform run commands on file servers in response to discovery, we recommend you make the server or servers part of a domain.

However, strict GPOs may interfere and affect system performance, and even cause the system to halt. Hence, when putting Data Security servers into a domain, it is advised to make them part of organizational units that don't enforce strict GPOs.

Also, certain real-time antivirus scanning can downgrade system efficiency, but that can be relieved by excluding some directories from that scanning (see Excluding Websense files from antivirus scans). Please contact Websense Technical Support for more information on enhancing performance.