Installing Remote Filtering Server on Windows

Deploying the Remote Filter Module | Forcepoint URL Filtering | v8.4.x, v8.5.x

Make sure the installation machine meets the Remote Filtering Server hardware and software requirements, then install the component as follows. If you plan to use additional Remote Filtering Server instances for failover purposes, perform this procedure on each Windows machine.

Part I: Preparing to install

Make sure that Policy Broker, Policy Server, and Filtering Service are installed and running in the network.

Log on to the Remote Filtering Server installation machine with domain and local administrator privileges.

Close all applications and stop any anti-virus software on the machine.

If you do not have a local copy of the Forcepoint Security Installer package to reuse, download the setup package:

Log on to the My Account page at forcepoint.com, and then go to the Downloads tab. If you do not have an account, follow the instructions on the page to create one.

Identify your product, navigate to the Windows installation package, and then click download.

Double-click the downloaded file. If prompted, click Run to start the extraction program. The installation program starts automatically.

If another program, such as Internet Explorer, is running, installation screens may be hidden behind that program's window.

Part II: Selecting components

When the Welcome screen appears, click Start, then accept the subscription agreement and click Next.

On the Installation Type screen, select Custom, and then click Next, then click Next again on the Summary screen.

On the Custom Installation screen, click the Install link next to Forcepoint Web Security or URL Filtering.

On the Welcome screen for the Web Protection Solutions setup program, click Next.

Accept the subscription agreement, then click Next.

If a list displays IP addresses for multiple network cards (NICs), select the IP address for the NIC that Remote Filtering Server will use to communicate with other web protection components inside the network firewall, and then click Next.

Select the Custom installation type, then click Next.

On the Select Components screen, select Remote Filtering Server.

When Remote Filtering Server is installed on a Windows machine, the Forcepoint Endpoint Package Builder, used to create Remote Filtering Client installation packages, is installed automatically on the same machine.

Part III: Defining the Remote Filtering Server initial configuration

Enter the Policy Server IP address and Port (55806, by default).


	Important Be sure that any firewall between Remote Filtering Server and Policy Broker, Policy Server, and Filtering Service have been configured to permit traffic over the ports needed for installation and operation. See Preparing for installation.

To enable Remote Filtering Clients to connect to Remote Filtering Server both from inside and from outside the Internet gateway or network firewall, provide the following information, and then click Next.


Field	Description
External IP address or fully qualified domain name	IP address or fully qualified domain name visible from outside the network firewall. IMPORTANT: Remember which format you use for this address. You must use the same external address in the same address format—IP address or fully qualified domain name (FQDN)—when you install Remote Filtering Client.
External port	Port number (from 10 to 65535) that is not in use, and that is accessible from outside the network firewall. The default value is 80. (If there is a Web server installed on the machine, port 80 may already in use, so you may need to choose a different port.) IMPORTANT: The port entered as the External Communication Port must be opened on your network firewall to accept connections from Remote Filtering Clients on computers located outside the firewall.
Internal port	Port number (from 1024 to 65535) that is not in use, and that is accessible only from inside the network firewall. The default value is 8800. This is the port over which heartbeats are sent. IMPORTANT: Be sure that your network firewall is configured to block connections to the Internal Communication Port from computers located outside the firewall.

When asked for a pass phrase, consider the following information:

The pass phrase can be up to 32 characters in length. This pass phrase is combined with unpublished keys to create an encrypted authentication key (shared secret) for secure client/server communication.

If you want this installation of Remote Filtering Server to function as a backup (secondary or tertiary) server for a primary Remote Filtering Server, you must enter the same pass phrase used when installing the primary Remote Filtering Server.

The pass phrase must include only ASCII characters, but can not include spaces. Do not use extended ASCII or double-byte characters.

You must use this pass phrase when you install the Remote Filtering Clients that will connect with this server.


	Warning Record your pass phrase and keep it in a safe place. Your web protection software cannot be used to retrieve it later.

Enter and confirm your pass phrase, and then click Next.

When asked for Filtering Service information, provide the following, and then click Next.


Field	Description
Internal IP address	IP address of the machine running Filtering Service.
A firewall or other network device...	Mark this check box if a firewall or other network device performs network address translation between the Filtering Service machine and the Remote Filtering Server machine. Otherwise, clear this check box.
Translated IP address	Enter the translated (external) Filtering Service IP address only if the check box is marked.
Filtering port	Port Filtering Service uses for communication with other Forcepoint services. IMPORTANT: Be sure this port is open on the firewall that separates Filtering Service and Remote Filtering Server.
Block page port	Port Filtering Service uses to send block pages to client machines. IMPORTANT: Be sure this port is open on the firewall that separates Filtering Service and Remote Filtering Server.

Part IV: Completing the installation

Accept the default installation path, or click Browse to locate another installation folder. Then, click Next.

The installer compares the system requirements for the installation you have selected with the resources of the installation machine.

If the installation machine has insufficient disk space, the installer displays a message that it must exit. Click Exit Setup, and install Remote Filtering Server on a different machine.

If the installation machine has less than the recommended amount of memory, a warning is displayed, but the installation can continue. Click Next.

Review the installation summary, and then click Next to start the installation.

Click Next to exit the installer.

Restart any antivirus or other software that was stopped for the installation.

Create one or more Remote Filtering Client installation packages and deploy Remote Filtering Client to the machines you want to filter when outside the network. See Deploying Remote Filtering Client.


	Important If Network Agent or an integration product is configured to manage HTTP requests in your network, make sure that it is not monitoring requests going to or from the Remote Filtering Server machine. For information about configuring Network Agent, see the Network Agent Quick Start paper.