Additional configuration for the Web DLP Module

Deployment and Installation Center | TRITON AP-WEB | v8.0.x

Applie to:

In this topic:

TRITON AP-WEB, v8.0.x

Confirm Content Gateway registration with TRITON AP-DATA

Configuring the Content Gateway policy engine

Verifying Web and data security linking

In addition to the items under Initial configuration for web protection solutions, perform these procedures if your subscription includes the Web DLP Module.

When Content Gateway v8.0.0 and TRITON AP-DATA v8.0.0 are deployed together and any of the following file types are used, you must apply Content Gateway v8.0 Hotfix 1. If you do not, files of these types are not detected by Content Gateway.

JT Assembly File

STL CAD binary format

PRO/Engineer Format (.prt)

PRO/Engineer Format (.drw)

PRO/Engineer Format (.asm)

PRO/Engineer Format (.frm)

To obtain the hotfix, visit MyWebsense.com, select TRITON AP-WEB v8.0, and then select "v8.0.0 HF 01 WCG Failed to Detect AP-DATA File Types".

Confirm Content Gateway registration with TRITON AP-DATA

Content Gateway registers with TRITON AP-DATA automatically. To ensure that registration is successful:

Synchronize the date and time on the Content Gateway and TRITON management server machines to within a few minutes.

If Content Gateway is deployed as a transparent proxy, ensure that traffic to and from the communication interface ("C" on a V-Series appliance) is not subject to transparent routing. If it is, the registration process will be intercepted by the transparent routing and will not complete properly.

Make sure that the IPv4 address of the eth0 NIC on the Content Gateway machine is available (not required if Content Gateway is located on a V-Series appliance). This is the NIC used by the TRITON management server during the registration process.

After registration, the IP address can move to another network interface.

If registration fails an alarm displays in the Content Gateway manager.

Verify connectivity between Content Gateway and the TRITON management server.

In the Content Gateway manager, navigate to the Configure > My Proxy > Basic > General page.

In the Networking section, confirm that TRITON AP-DATA > Integrated on-box is enabled.

Restart Content Gateway to initiate another registration attempt.

Alternatively:

Go to Configure > Security > TRITON AP-DATA and enter the IP address of the TRITON management server.

Enter a user name and password for a TRITON AP-DATA administrator with Deploy Settings privileges.

Click Register.

After Content Gateway has registered with TRITON AP-DATA, in Content Gateway Manager go to Configure > Security > TRITON AP-DATA and set the following options:

Analyze FTP Uploads: Enable this option to send FTP uploads to TRITON AP-DATA for analysis and policy enforcement.

Analyze Secure Content: Enable this option to send decrypted HTTPS posts to TRITON AP-DATA for analysis and policy enforcement. SSL Manager must be enabled on Content Gateway.

These options can be accessed whenever TRITON AP-DATA is registered by going to the Configure > Security > TRITON AP-DATA > General page.

Click Apply and restart Content Gateway.

TRITON AP-DATA and the proxy communicate over ports 17000-17014.

Configuring the Content Gateway policy engine

When Content Gateway is registered with the TRITON management server, a Content Gateway module appears on the Data Security manager System Modules page.

By default, this agent is configured to monitor web traffic, not block it, and for a default violation message to appear when an incident is triggered. If this is acceptable, you do not need to make changes to the Content Gateway configuration. Simply deploy the new settings.

If you want to block web traffic that breaches policy and customize the violation message, do the following:

From the Data module of the TRITON manager, select Settings > Deployment > System Modules.

Select the Content Gateway module in the tree view (click the module name itself, not the plus sign next to it).

It will be listed as Content Gateway on <FQDN> (<PE_version>), where <FQDN> is the fully-qualified domain name of the Content Gateway machine and <PE_version> is the version of the Content Gateway policy engine.

Select the HTTP/HTTPS tab and configure the blocking behavior you want.

Select Help > Explain This Page for instructions for each option.

Select the FTP tab and configure the blocking behavior you want.

Select Help > Explain This Page for instructions for each option.

Click Save to save your changes.

Click Deploy to deploy your settings.


	Important Even if you do not change the default configuration, you must click Deploy to finalize your Content Gateway deployment process.

Verifying Web and data security linking

When Linking Service is installed, it automatically configures linking between Web and TRITON AP-DATA to allow the system access to user identification and URL categorization data.

Log onto the Data module of the TRITON Manager.

Select Settings (under General) > System > URL Categories & User Names.

Verify settings and test the connection.

Select Help > Explain This Page for detailed information about the settings on this screen.

Click OK to save any changes.

Click Deploy to deploy your settings.