Installing Websense Content Gateway

Deployment and Installation Center | Web Security Solutions | Version 7.7.x

Web Security Gateway and Web Security Gateway Anywhere, v7.7.x

Complete these steps to install Websense Content Gateway (Content Gateway) on a server in a software-base deployment of Websense software. In a Websense-appliance-based deployment, Content Gateway is already installed on the appliance.

Before you begin, be sure to read Preparing to install Websense Content Gateway.

Disable any currently running firewall on this machine for the duration of Content Gateway installation. Bring the firewall back up after installation is complete, opening ports used by Content Gateway.

For example, if you are running IPTables:

At a command prompt, enter service iptables status to determine if the firewall is running.

If the firewall is running, enter service iptables stop.

After installation, restart the firewall. In the firewall, be sure to open the ports used by Content Gateway on this machine. See Ports for more information.

Download the WebsenseCG77xSetup_Lnx.tar.gz tar archive, from mywebsense.com to a temporary directory.

Create a directory for the tar archive, and then move the archive to the new directory. For example:

mkdir wcg_v77

mv <installer tar archive> wcg_v77

Change to the directory you created in Step a.

cd wcg_v77

Unpack the tar archive:

tar -xvzf <installer tar archive>s


	Important If SELinux is enabled, set it to permissive or disable it before installing Content Gateway. Do not install or run Content Gateway with SELinux enabled.

Make sure you have root permissions:

su root

In the directory where you unpacked the tar archive, begin the installation, and respond to the prompts to configure the application.

./wcg_install.sh

The installer installs Content Gateway in /opt/WCG. It is installed as root.


	Note Up to the configuration summary (Step 17 below), you can quit the installer by pressing CTRL-C. If you choose to continue the installation past the configuration summary and you want to quit, do not use CTRL-C. Instead, allow the installation to complete and then uninstall it. If you want to change your answer to any of the installer prompts, you will be given a chance to start over at the first prompt once you reach the configuration summary; you do not have to quit the installer.

If your system does not meet the minimum recommended requirements, you receive a warning. For example:

Warning: Websense Content Gateway requires at least 4 gigabytes of RAM.

Do you wish to continue [y/n]?

Enter n to end the installation, and return to the system prompt.

Enter y to continue the installation. If you choose to run Content Gateway after receiving this warning, performance may be affected.


	Note See also Installer gives NetworkManager or avahi-daemon error.

Read the subscription agreement. At the prompt, enter y to continue installation or n to cancel installation.

Do you accept the above agreement [y/n]? y

Enter and confirm a password for the Content Gateway Manager administrator account:

Enter the administrator password for the Websense Content Gateway management interface.

Username: admin

Password:> (note: cursor will not move as you type)

Confirm password:>

This account enables you to log on to the management interface for Content Gateway, known as Content Gateway Manager. The default username is admin.

To create a strong password (recommended), use 8 or more characters, with at least 1 each of the following: capital letter, lower case letter, number, special character.

Important

The password length must be 16 characters or less. Also, it cannot contain the following characters:

space

$ (dollar symbol)

: (colon)

' (backtick; typically shares a key with tilde, ~)

\ (backslash)

" (double-quote)


	Note As you type a password, it may seem that nothing is happening—the cursor will not move nor will masked characters be shown—but the characters are being accepted. After typing a password, press Enter. Then repeat to confirm it.

Enter an email address where Content Gateway can send alarm messages:

Websense Content Gateway requires an email address for alarm notification.

Enter an email address using @ notation: [] >

Be sure to use @ notation (for example, user@example.com). Do not enter more than 64 characters for this address.

Enter the IP address for Policy Server:

Enter the Policy Server IP address (leave blank if integrating with Data Security only): [] >

Use dot notation (i.e., xxx.xxx.xxx.xxx). The address must be IPv4. Press Enter to leave this field blank if this Content Gateway deployment is with Websense Data Security only.

10.

Enter the IP address for Filtering Service:

Enter the Filtering Service IP address: [<Policy Server address>] >

The default is the same address as Policy Server. This field does not appear if you did not enter an IP address for Policy Server in Step 9.

11.

Review default Content Gateway ports:

Websense Content Gateway uses 11 ports on your server:

----------------------------------------------
'1' Websense Content Gateway Proxy Port 8080
'2' Web Interface port 8081
'3' Auto config port 8083
'4' Process manager port 8084
'5' Logging server port 8085
'6' Clustering port 8086
'7' Reliable service port 8087
'8' Multicast port 8088
'9' HTTPS inbound port 8070
'N' HTTPS outbound port 8090
'M' HTTPS management port 8071

Enter the port assignment you would like to change:

'1-9,N,M,D' - specific port changes
'X' - no change
'H' - help
[X] >

Ports preceded by numbers in the list are considered the 9 ports for Content Gateway. Ports preceded by letters are needed if you have subscribed to Websense Web Security Gateway or Web Security Gateway Anywhere.

Change a port assignment if it will conflict with another application or process on the machine. Otherwise, leave the default assignments in place.

If you do not want to use these ports for Content Gateway, or if the installation program indicates that a port conflict exists, make any necessary changes. Any new port numbers you assign must be between 1025 and 65535, inclusive.

12.

For clustering, at least two network interfaces are required. If your machine has only one, the following prompt appears:

Websense Content Gateway requires at least 2 interfaces to support clustering. Only one active network interface is detected on this system.

Press ENTER to continue installation and skip to Step 14.

13.

If two or more network interfaces are found on this machine, you are asked whether this instance of Content Gateway should be part of a cluster:

Websense Content Gateway Clustering Information

------------------------------------------------

'1' - Select '1' to configure Websense Content Gateway
for management clustering. The nodes in the cluster
will share configuration/management information
automatically.

'2' - Select '2' to operate this Websense Content Gateway
as a single node.

Enter the cluster type for this Websense Content Gateway installation:

[2] >

If you do not want this instance of Content Gateway to be part of a cluster, enter 2.

If you select 1, provide information about the cluster:

Enter the name of this Websense Content Gateway cluster.

><cluster_name>

Note: All members of a cluster must use the same cluster name.

Enter a network interface for cluster communication.

Available interfaces:
<interface, e.g., eth0>
<interface, e.g., eth1>

Enter the cluster network interface:

Enter a multicast group address for cluster <cluster_name>.
Address must be between 224.0.1.27 - 224.0.1.254:
[<default IP address>] >

14.

For Content Gateway to act as a Web cache, a raw disk must be present on this machine. If no raw disk is detected, the following prompt appears:

No disks are detected for cache.

Websense Content Gateway will operate in PROXY_ONLY mode.

Content Gateway will operate as a proxy only and will not cache Web pages. Press ENTER to continue the installation and skip to Step 16.

15.

If a raw disk is detected, you can enable the Web cache feature of Content Gateway:


	Note If you choose to not enable raw disk cache now, cache disks may be added after Content Gateway has been installed. For instructions, see Content Gateway Manager Help.

Would you like to enable raw disk cache [y/n]? y

Select available disks from the list. Selected disks become dedicated cache disks and cannot be used for any other purpose. Cache disks must be raw. Aggregate disk cache size should not exceed 147 GB.

Select available disk resources to use for the cache. Remember that space used for the cache cannot be used for any other purpose.

Here are the available drives

(1) /dev/sdb 146778685440 0x0

Note: The above drive is only an example.


	Warning Although it might be listed as available, do not use an LVM (Logical Volume Manager) volume as a cache disk.

Indicate if you want to add or remove disks individually or as a group.

Choose one of the following options:

'A' - Add disk(s) to cache

'R' - Remove disk(s) from cache

'S' - Add all available disks to cache

'U' - Remove all disks from cache

'X' - Done with selection, continue Websense
Content Gateway installation.

Option: > A

[ ] (1) /dev/sdb 146778685440 0x0

Specify which disk(s) to use for the cache.

Enter number to add item, press 'F' when finished:

[F] >1

Item '1' is selected

[F] >

Your selections are confirmed. Note the "x" before the name of the disk.

Here is the current selection

[X] (1) /dev/sdb 146778685440 0x0

Continue based on your choice in Step b, pressing X when you have finished configuring cache disks.

Choose one of the following options:

'A' - Add disk(s) to cache

'R' - Remove disk(s) from cache

'S' - Add all available disks to cache

'U' - Remove all disks from cache

'X' - Done with selection, continue Websense
Content Gateway installation.

Option: >X

16.

You can elect to send Websense, Inc., information about scanned content (Note: individual users are never identified):

Websense Content Gateway has the ability to send usage statistics, information about scanned content and activated product features to Websense Inc. for the purpose of improving the accuracy of scanning, filtering and categorization.

Would you like to allow this communication with Websense, Inc. ? [y/n]

17.

A configuration summary appears, showing your answers to the installer prompts (note: summary below is an example):

Configuration Summary
-----------------------------------------------------------
Websense Content Gateway Install Directory : /opt/WCG
Admin Username for Content Gateway Manager: admin
Alarm Email Address : <email address>

Policy Server IP Address : <IP address>
Filtering Service IP Address : <IP address>

Websense Content Gateway Cluster Type : NO_CLUSTER

Websense Content Gateway Cache Type : LRAW_DISK
Cache Disk : /dev/sdb
Total Cache Partition Used : 1

*******************
* W A R N I N G *
*******************
CACHE DISKS LISTED ABOVE WILL BE CLEARED DURING
INSTALLATION!! CONTENTS OF THESE DISKS WILL BE
COMPLETELY LOST WITH NO CHANCE OF RETRIEVAL.

Installer CANNOT detect all potential disk mirroring
systems. Please make sure the cache disks listed
above are not in use as mirrors of active file
systems and do not contain any useful data.

Do you want to continue installation with this configuration [y/n]?

If you want to make changes, enter n to restart the installation process at the first prompt. To continue and install Content Gateway configured as shown, enter y.


	Important If you enter y to proceed but you decide you want to cancel the installation, do not attempt to quit the installer by pressing CTRL-C. Allow the installation to complete. Then uninstall it.

18.

Wait for the installation to complete.

Note the location of the certificate required for Content Gateway Manager: /root/WCG/content_gateway_ca.cer. See the Getting Started section of the Content Gateway Manager Help for information on importing this certificate.


	Note The subscription key is shared automatically with Content Gateway if it has already been specified in TRITON –Web Security. If you receive an email from Content Gateway (to the address you specified during installation) with "WCG license download failed" in the subject line, this alert does not mean a problem occurred with the installation. The alert indicates that your deployment may require you to manually enter the subscription key in Content Gateway Manager. See the Getting Started section of the Content Gateway Manager Help for information on entering your subscription key.

19.

When installation is complete, reboot the Content Gateway server.

20.

When the reboot is complete, check Content Gateway status with:

/opt/WCG/WCGAdmin status

All services should be running. These include:

Content Cop

Websense Content Gateway

Content Gateway Manager

Analytics Server