Technical Library | Support

Go to the table of contents Go to the previous page Go to the next page
Installing Websense Content Gateway > Preparing to install Websense Content Gateway
Preparing to install Websense Content Gateway
Deployment and Installation Center | Web Security Solutions | Version 7.8.x
 
Applies to:                                         
In this topic                                       
*
Web Security Gateway and Web Security Gateway Anywhere, v7.8.x
*
Downloading the installer
*
Internet connectivity
*
Security of the Content Gateway machine
*
Explicit or Transparent Proxy
*
System requirements for Websense Content Gateway
*
Hostname and DNS configuration for Content Gateway
*
Preparing a cache disk for use by Websense Content Gateway
*
Preparing for a clustered deployment of Websense Content Gateway
 
Before installing Websense Content Gateway (Content Gateway) on the host machine, you must perform the following tasks and consider the following issues.
Downloading the installer
1.
Download the WebsenseCG78Setup_Lnx.tar.gz installer tar archive, from mywebsense.com to a temporary directory.
2.
Create a directory for the tar archive, and then move the archive to the new directory. For example:
mkdir wcg_v78
mv WebsenseCG78Setup_Lnx.tar.gz ./wcg_v78/
3.
Change to the directory you created in Step 2.
cd wcg_v78
4.
Unpack the tar archive:
tar -xvzf WebsenseCG78Setup_Lnx.tar.gz
Internet connectivity
It is recommended that the Content Gateway host machine have Internet connectivity before starting the installation procedure. The software will install without Internet connectivity, but analytic database updates cannot be performed until Internet connectivity is available.
Security of the Content Gateway machine
Consider the following security issues prior to installing Content Gateway:
Physical security
Physical access to the system can be a security risk. Unauthorized users could gain access to the file system, and under more extreme circumstances, examine traffic passing through Content Gateway. It is strongly recommended that the Content Gateway server be locked in an IT closet and that a BIOS password be enabled.
Root permissions
Ensure that root permissions are restricted to a select few persons. This important restriction helps preclude unauthorized access to the Websense Content Gateway file system.
Ports
For a list of default ports, see Content Gateway ports. They must be open to support the full set of Websense Web Security Gateway features.
 
* 
Note 
If you customized any ports that Websense software uses for communication, replace the default port with the custom port you implemented.
Restrict inbound traffic to as few other ports as possible on the Websense Content Gateway server. In addition, if your subscription does not include certain features, you can restrict inbound traffic to the unneeded ports. For example, if your subscription does not include Websense Data Security, you may choose to restrict inbound traffic to those ports related to Websense Data Security.
IPTables Firewall
If your server is running the Linux IPTables firewall, you must configure the rules in a way that enables Content Gateway to operate effectively. See the IPTables for Content Gateway article in the Websense Technical Library.
Explicit or Transparent Proxy
Content Gateway can be used as an explicit or transparent proxy. This section contains the following topics:
*
Explicit proxy
*
Configuring client browsers for explicit proxy
*
Configuring Internet Explorer 8.0 and later for explicit proxy
*
Configuring Firefox 5.x for explicit proxy
Explicit proxy
Explicit proxy deployment requires directly pointing client Web browsers, and other client applications, to Content Gateway for HTTP, and optionally, HTTPS and FTP traffic. This is accomplished using a PAC file, WPAD, or by having the user edit browser settings to point to Content Gateway.
One issue to consider with explicit deployment is that a user can point his or her browser to another destination to bypass Content Gateway. You can address this by setting and propagating browser configuration in your organization through Group Policy (GPO), a Windows Server feature. For more information about Group Policy, search the Microsoft TechNet website at http://technet.microsoft.com. An additional way to mitigate the risk of users bypassing Content Gateway is the use of corporate outbound firewall rules.
Multiple proxies can provide for redundancy using Virtual Router Redundancy Protocol (VRRP). Using a single IP address, requests are sent to an alternate proxy in the event of failure. VRRP is not invoked until there is a failure with one of the proxies. See RFC 3768 for information on VRRP.
Configuring client browsers for explicit proxy
For explicit proxy deployments, you must configure each client browser to send Internet requests to Content Gateway, over the ports that Content Gateway uses for the associated protocol.
The default proxy port in Content Gateway for both HTTP and HTTPS traffic is 8080. The default port for FTP is 2121.
Use the instructions below to configure client browsers manually. Alternatively, use a PAC or WPAD file to configure client browsers.
 
* 
Note 
The instructions below are for the most common client browsers. For other client browsers refer to the browser's documentation.
Configuring Internet Explorer 8.0 and later for explicit proxy
1.
In Internet Explorer, select Tools > Internet Options > Connections > LAN Settings.
2.
Select Use a proxy server for your LAN.
3.
Click Advanced.
4.
For HTTP, enter the Content Gateway IP address and specify port 8080.
5.
For Secure, enter the Content Gateway IP address and specify port 8080.
6.
Clear Use the same proxy server for all protocols.
7.
Click OK to close each screen in this dialog box.
Configuring Firefox 5.x for explicit proxy
1.
In Firefox, select Tools > Options > Advanced, and then select the Network tab.
2.
Select Settings.
3.
Select Manual proxy configuration.
4.
For HTTP Proxy, enter the Content Gateway IP address and specify port 8080.
5.
For SSL Proxy, enter the Content Gateway IP address and specify port 8080.
6.
Click OK to close each screen in this dialog box.
Transparent proxy
In transparent proxy deployments, client requests are intercepted and redirected to Content Gateway, without client involvement, via a WCCP v2-enabled router or Layer 4 switch. In a multiple-proxy (cluster) deployment, a WCCP v2-enabled router also supports load distribution among proxies.
See Content Gateway Manager Help for additional information on configuring a WCCP v2-enabled router or a Layer 4 switch, and about the ARM (Adaptive Redirection Module).
System requirements for Websense Content Gateway
*
Hardware
*
Software
*
Preparing a cache disk for use by Websense Content Gateway
Hardware
 
CPU
Quad-core running at 2.8 GHz or faster
Memory:
Red Hat Enterprise Linux 6 series, 64-bit
 
6 GB minimum
8 GB recommended
Disk space
2 disks:
*
100 GB for the operating system, Content Gateway, and temporary data.
 
*
147 GB for caching
If caching will not be used, this disk is not required.
The caching disk:
*
Should be at least 2 GB and no more than 147 GB
*
Must be a raw disk, not a mounted file system
*
Must be dedicated
*
Must not be part of a software RAID
*
Should be, for best performance, a 10K RPM SAS disk on a controller that has at least 64 MB of write-through cache
Network Interfaces
2
To support transparent proxy deployments
Router
Must support WCCP v2.
A Cisco router must run IOS 12.2 or later. The latest version is recommended.
Client machines, the destination Web server, and Content Gateway must reside on different subnets.
—or—
Layer 4 switch
 
You may use a Layer 4 switch rather than a router.
To support WCCP, a Cisco switch requires the EMI or IP services image of the 12.2SE IOS release (or later).
Websense Content Gateway must be Layer 2 adjacent to the switch.
The switch must be able to rewrite the destination MAC address of frames traversing the switch.
The switch must be able to match traffic based on the layer 4 protocol port (i.e., TCP port 80).
 
Software
Content Gateway version 7.8.x is certified on:
*
Red Hat Enterprise Linux 6 series, 64-bit, Basic Server
*
Kernel version for 6.5: 2.6.32-431 (not recommended for v7.8.3 Content Gateway)
*
Kernel version for 6.4: 2.6.32-358
*
Kernel version for 6.3: 2.6.32-279
*
Kernel version for 6.2: 2.6.32-220
*
Kernel version for 6.1: 2.6.32-131
*
Kernel version for 6.0: 2.6.32-71
*
V-Series appliances
Content Gateway is supported on:
*
The corresponding CentOS version (CentOS version numbers have a one-to-one correspondence with Red Hat Enterprise Linux version numbers)
Although not certified, Websense, Inc. provides "best effort" support for newer versions of Red Hat Enterprise Linux. Under "best effort" support, Websense Technical Support makes a best effort to troubleshoot cases in standard fashion unless the issue is deemed a Red Hat Enterprise Linux-specific issue, at which point you must contact Red Hat directly for assistance.
Only kernels shipped with the above Linux versions are supported by Websense Content Gateway. Visit www.redhat.com for kernel information. To display the kernel version installed on your system, enter the command:
/bin/uname -r
For more information on installing on Red Hat Enterprise Linux, see Requirements for Red Hat Enterprise Linux.
Websense Web Security core policy components
Version 7.8 is required.
 
* 
Important 
Websense core policy components must be installed prior to Content Gateway. When Filtering Service is installed, Content Gateway must be specified as the integration product. See:
*
Installation Instructions: Web Security Gateway Anywhere
*
Installation Instructions: Web Security Gateway
Integration with Websense Data Security
Version 7.8 is required.
*
Any version can be used via the ICAP interface. However, use of the integrated, on-box components is strongly recommended. See Content Gateway Manager Help for configuration instructions.
Web browsers
Content Gateway is configured and maintained with a web-based user interface called the Content Gateway manager. The Content Gateway manager supports the following web browsers:
*
Internet Explorer 8, 9, 10 and 11
*
Mozilla Firefox 5 and later
*
Google Chrome 13 and later
 
* 
Note 
The browser restrictions mentioned above apply only to the Content Gateway Manager and not to client browsers proxied by Content Gateway.
Hostname and DNS configuration for Content Gateway
Configure a hostname for the Content Gateway machine and also configure DNS name resolution. Complete these steps on the machine on which you will install Content Gateway.
1.
Configure the hostname:
hostname <hostname>
where <hostname> is the name you are assigning this machine.
 
* 
Important 
The hostname must be 15 characters or less.
2.
Update the HOSTNAME entry in the /etc/sysconfig/network file:
HOSTNAME=<hostname>
where <hostname> is the same as in Step 1.
3.
Specify the IP address to associate with the hostname in the /etc/hosts file. This should be static and not served by DHCP. The proxy uses this IP address in features such as transparent authentication and hierarchical caching. This must be the first line in the file. Do not delete the second and third lines (the ones that begin with "127.0.0.1" and "::1", respectively).
xxx.xxx.xxx.xxx <FQDN> <hostname>
127.0.0.1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6
<FQDN> is the fully-qualified domain name of this machine
(i.e., <hostname>.<subdomain(s)>.<top-level domain>).
For example: myhost.example.com
<hostname> is the same name specified in Step 1.
Do not reverse the order of the FQDN and hostname.
4.
Configure DNS in the /etc/resolv.conf file.
search <subdomain1>.<top-level domain> <subdomain2>.<top-level domain> <subdomain3>.<top-level domain>
nameserver xxx.xxx.xxx.xxx
nameserver xxx.xxx.xxx.xxx
This example demonstrates that more than one domain can be listed on the search line. Listing several domains may have an impact on performance, because each domain is searched until a match is found. Also, this example shows a primary and secondary nameserver being specified.
5.
Gather this information:
*
Default gateway (or other routing information)
*
List of your company's DNS servers and their IP addresses
*
DNS domains to search, such as internal domain names. Include any legacy domain names that your company might have.
*
List of additional firewall ports to open beyond SSH (22) and the proxy ports (8080-8090). See Ports.
Preparing a cache disk for use by Websense Content Gateway
For Websense Content Gateway to operate as a caching proxy, it must have access to at least one raw disk. Otherwise, Content Gateway will function as a proxy only.
To create a raw disk for the proxy cache when all disks have a mounted file system:
 
* 
Note 
This procedure is necessary only if you want to use a disk already mounted to a file system as a cache disk for Content Gateway. Perform this procedure before installing Content Gateway.
* 
Warning 
Do not use an LVM (Logical Volume Manager) volume as a cache disk.
* 
Warning 
The Content Gateway installer will irretrievably clear the contents of cache disks.
1.
Enter the following command at the prompt to examine which file systems are mounted on the disk you want to use for the proxy cache:
df -k
2.
Open the file /etc/fstab and comment out or delete the file system entries for the disk.
3.
Save and close the file.
4.
Enter the following command for each file system you want to unmount:
umount <file_system>
where <file_system> is the file system you want to unmount.
When the Content Gateway installer prompts you for a cache disk, select the raw disk you created.
 
* 
Note 
It is possible to add cache disks after Content Gateway is installed. For instructions, see the Content Gateway Manager Help.
Preparing for a clustered deployment of Websense Content Gateway
If you plan to deploy multiple, clustered instances of Content Gateway:
*
Find the name of the network interface you want to use for cluster communication. This must be a dedicated interface.
*
Find or define a multicast group IP address.
 
* 
Note 
If a multicast group IP address has not already been defined, enter the following at a command line to define the multicast route:
route add <multicast.group address>/32 dev <interface_name>
where <interface_name> is the name of the interface used for cluster communication. For example:
route add 224.0.1.37/32 dev eth1

Go to the table of contents Go to the previous page Go to the next page
Installing Websense Content Gateway > Preparing to install Websense Content Gateway
Copyright 2016 Forcepoint LLC. All rights reserved.