Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Network Agent Quick Start : Configuring Network Agent
Configuring Network Agent
Network Agent Quick Start | Web Protection Solutions | v8.0.x, v8.1.x | 12-Oct-2015
Use the TRITON Manager to configure Network Agent to recognize machines in your internal network, communicate with Filtering Service, monitor traffic from specified machines, log appropriate data, and more.
Configure Global settings
Refer to Planning Worksheet 1 for help in configuring Network Agent Global settings. All Network Agent instances in your network use these settings.
1.
In the Web module of the TRITON Manager, go to the Settings > Network Agent > Global page.
2.
Make sure that the Ignore Internal Traffic list includes all IP addresses in your network.
 
Important 
This information is not used to determine which machines are monitored for policy enforcement. Instead, it allows Network Agent to ignore internal communications while monitoring Internet traffic.
An initial set of entries is provided by default. You can add additional entries, or edit or delete existing entries.
IP addresses and ranges in the list may use IPv4 or IPv6 format.
Be sure to include all IP addresses that are part of your network, whether or not you want Network Agent to monitor traffic to or from the machine. Later, you will configure whether Network Agent monitors traffic to specific internal IP addresses, and specify which IP addresses are monitored for outgoing Internet traffic.
*
Click Add to add an IP address or IP address range to the list.
*
*
IP address ranges in the list cannot overlap, and you cannot enter an individual IP address that falls within a range already in the list.
3.
Use the Internal Traffic to Monitor list to specify internal IP addresses (included in the network definition list) for which you do want Network Agent to monitor connections from other internal IP addresses. You might include internal web servers, for example, to help track access to internal resources.
*
*
4.
Use the Additional Settings options allow you to determine how often Network Agent calculates bandwidth usage, and whether and how often protocol traffic is logged:
5.
When you are finished making changes, click OK to cache the changes. Changes are not implemented until you click Save and Deploy.
Configure local settings
Refer to Planning Worksheets 2 and 3 for help in configuring local settings. Only the selected Network Agent instance uses these settings.
1.
Under Settings > Network Agent, highlight or mouse over Global, then select the IP address of the Network Agent instance that you want to configure.
When the local settings page opens, the IP address of the selected instance appears in the title bar at the top of the content pane.
2.
Select the Filtering Service IPv4 address that identifies the Filtering Service instance with which this Network Agent will communicate (Planning Worksheet 2). If Network Agent and Filtering Service are installed on the same machine, the local IP address is selected by default.
3.
4.
Under the Network Interface Cards list, use the Proxies and Caches list to specify any proxy or cache machines that monitored machines use to access the Internet. This keeps Network Agent from identifying requests from both the client machine and the proxy or cache machine, which could result in duplicate log records or incorrect filtering.
Click Add to include a proxy or cache IP address in the list.
5.
Expand Advanced Network Agent Settings.
a.
With TRITON AP-WEB, or when Web Filter & Security is integrated with a third-party product, verify that the Integration manages HTTP traffic on ports value is correct. (The default is 80, 8080.)
If you have installed Websense software in standalone mode, all ports are monitored and the field is disabled.
b.
If you want Network Agent to ignore traffic on specific ports, mark Configure this Network Agent instance to ignore traffic on the following ports, and then enter one or more ports in a comma-separated list.
This may be used to prevent double logging of HTTPS traffic.
Do not make changes to the Debug Settings options unless directed to do so by Websense Technical Support.
6.
Click OK to cache your changes. Changes are not saved until you click Save and Deploy.
Configure NIC settings
Refer to Planning Worksheet 4 for help in configuring NIC settings. These settings determine which NIC is used for monitoring and which is used for blocking and communication with other Websense components. They also determine which IP addresses this Network Agent instance monitors, and how the agent responds to requests for non-HTTP protocols.
1.
Click an entry in the Network Interface Cards list on the Local Settings page for the Network Agent instance that you are configuring.
The NIC Information list provides a description of the selected network card.
2.
Indicate whether or not to Use this NIC to monitor traffic.
If the Network Agent machine has multiple NICs, you can configure more than one NIC to monitor traffic.
*
If this NIC will be used for monitoring, click Configure, and continue with step 3.
*
3.
Use the Local Settings > NIC Configuration > Monitor List page to configure monitoring behavior:
*
Use the Monitor List to identify which IP addresses (All, None, or Specific) this Network Agent instance monitors.
If you select Specific, add the IPv4 or IPv6 address ranges and individual IPv4 or IPv6 addresses that this Network Agent should monitor.
*
Under Monitor List Exceptions, add any IP addresses within the monitored ranges that Network Agent should not monitor.
*
When you are finished making changes, click OK to return to the NIC Configuration page.
4.
Indicate which NIC Network Agent should use as a Blocking NIC. This NIC is also used for communication with other Websense software components, and must have an IP address.
5.
*
Select Log HTTP requests to improve accuracy in Websense reports.
*
Select Filter all requests not sent over HTTP ports to use Network Agent to filter only those HTTP requests not sent through the integration product.
If you are running Web Filter & Security in Stand-Alone mode, Filter and log HTTP requests is selected, and cannot be changed.
6.
Under Protocol Management, indicate whether Network Agent should be used to Filter non-HTTP protocol requests and Measure bandwidth by protocol.
Click OK to cache your changes, and then click Save and Deploy to implement them.
After configuring Network Agent, you may want to use a packet analyzer to ensure that the monitoring NIC is able to see traffic from all of the IP addresses that it is configured to monitor.
Wireshark is a free, popular, open source network protocol analyzer, available for Windows and Linux systems from www.wireshark.org.
If traffic from some IP addresses is not visible:
*
*
*

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Network Agent Quick Start : Configuring Network Agent
Copyright 2016 Forcepoint LLC. All rights reserved.