Deployment and Installation Center
Websense TRITON Enterprise v7.6.x

Go to the table of contents Go to the previous page Go to the next page Go to the index
Web Security Gateway (appliance-based) > Setting up the appliance

The Quick Start poster, included in the appliance shipping box, shows you all items included in each Websense appliance shipping box. The 2-page Quick Start explains how to set up the hardware and shows how to connect the cables to the appliance and to your network.
Network interface C and the proxy interface (typically P1) must be able to access a DNS server. Both interfaces typically have continuous access to the Internet. Essential databases are downloaded from Websense servers through these interfaces.
*
Ensure that interfaces C and P1 are able to access the download servers at download.websense.com. (As an alternative, some sites configure the P1 proxy interface to download the Websense Master Database as well as other security updates. In that situation, interface C does not require Internet access.)
*
Make sure that this address is permitted by all firewalls, proxy servers, routers, or host files that control the URLs that the C and P1 interfaces can access.
After hardware setup, connect directly to the appliance through the serial port or the monitor and keyboard ports. For serial port activation, use:
The first time you start a Websense appliance, a brief script (firstboot) prompts you to supply settings for the network interface labeled C and a few other general items. You can run the script again if you want to examine your settings or change settings. You can also change settings through the Appliance Manager (browser-based management application) after firstboot has been executed.
Gather the following information before running firstboot. Some of this information may have been written down on the Quick Start during hardware setup.
                                       
Configuring these interfaces to access the Internet for database downloads is done through the Appliance Manager and through the TRITON Unified Security Center. See the Appliance Manager Help for information about configuring the interfaces. See the TRTION - Web Security Help for information about configuring database downloads.
Note 
To configure the appliance, connect through the serial port or the keyboard/video ports and complete the firstboot script. For serial port activation, use:
3.
When asked if you want to begin, enter yes to launch the firstboot activation script.
4.
At the first prompt, select Web Security only mode:
After the activation script has been completed successfully, use the Logon Portal to access the Appliance Manager. To reach the Logon Portal, open a supported browser, and enter this URL in the address bar:
The Appliance Manager is the Web-based configuration interface for the appliance. Through it you can view system status, configure network and communication settings, and perform general appliance administration tasks.
After completing the initial configuration required by the firstboot script, use the Appliance Manager to configure important settings for network interfaces N and P1 (and optionally P2), which are used for communication by Network Agent and Websense Content Gateway. Appliance models V10000 and V10000 G2 also offer expansion interfaces (E1 and E2) that can be bonded with P1 and P2, respectively, either for load balancing or standby. Note that on a V5000 G2, there are no E1 and E2 interfaces.
If you use the P2 interface, the P1 interface is bound to eth0, and the P2 interface is bound to eth1. Keep this in mind when you configure Websense Content Gateway. For example, suppose you are using a transparent proxy deployment, and the P1 interface is connected to a WCCPv2 router. In this case, you must configure Websense Content Gateway to use eth0 for WCCP communications (in Content Gateway Manager, see Configure > Networking > WCCP).
Gather the following information before running the Appliance Manager. Some of this information may have been written on the Quick Start during hardware setup.
Be sure that interface C can access the NTP server. If interface C does not have Internet access, you can install an NTP server locally on a subnet that can be accessed by interface C.
If both P1 and P2 are used, the default gateway is automatically assigned to whichever interface is in the same subnet with it. If both P1 and P2 are in the same subnet, the default gateway is automatically assigned to P2 (which is bound to eth1).
Choose interface for transporting blocking
information for non-HTTP and non-HTTPS traffic (interface C or interface N)
If interface N transports blocking information, N must be connected to a bidirectional span port
Default gateway for network interface N
Required only if network interface N carries blocking information
Bond expansion interface E1 to P1? Yes or No
Optional; V10000 or V10000 G2 only
Bond expansion interface E2 to P2? Yes or No
Optional; V10000 or V10000 G2 only
*
User directory and filtering (you must specify the IP address of a machine running Policy Broker, which can be a full policy source appliance)
*
Filtering only (you must specify IP address of a machine running Policy Server, which can be a full policy source or user directory and filtering appliance).
TRITON Unified Security Center location (user interface for managing Web Security Gateway)
TRITON Unified Security Center can run on this appliance or on a separate Windows server. By default it is enabled to run on the appliance. During the setup procedure below you will decide where it should run.
Note: Organizations with high traffic volume or large reporting needs are encouraged to install and run TRITON Unified Security Center on a separate Windows server, to optimize performance.
*
Choose:
Runs on this appliance or
Follow these steps to enable default proxy caching and filtering. See the Appliance Manager Help for detailed instructions on any field or area, or for information about other available settings.
2.
Log on with the user name admin and the password set during initial appliance configuration.
3.
In the left navigation pane, click Configuration > System.
4.
Under Time and Date:
*
Automatically synchronize with an NTP server: select this option to use a Network Time Protocol server. Specify up to three NTP servers. Use of an NTP server is recommended, to ensure that database downloads and time-based policies are handled precisely.
*
Manually set time and date: select this option to enter a system time and date yourself.
c.
Click Save in the Time and Date area.
5.
In the left navigation pane, click Configuration > Network Interfaces.
6.
Under Websense Content Gateway Interfaces, configure the P1 and P2 (optional) interfaces.
a.
Select whether P1 only or both P1 and P2 are used.
If you choose P1 only, enter configuration information (IP address, subnet mask, default gateway, DNS IP addresses) under P1.
If you choose P1 and P2, enter configuration information under both P1 and P2. Note that default gateway and DNS configuration (under Shared Setting) are shared between both P1 and P2.
b.
Click Save in the Websense Content Gateway Interfaces area when you are done.
Important 
When you use the P2 interface, the P1 interface is bound to eth0, and the P2 interface is bound to eth1. Keep this in mind when you configure Websense Content Gateway.
For example, suppose you are using transparent proxy, and the P1 interface is connected to the WCCPv2 router. In this case, you must configure Websense Content Gateway to use eth0 for WCCP communications (in Content Gateway Manager: Configure > Networking > WCCP).
Alternatively, you could use both P1 and P2 such that P1 handles inbound traffic and P2 handles outbound traffic. To enable this configuration, be sure to set appropriate routing rules for P1 and P2 on the Configuration > Routing page. For example, you might set outbound traffic to go through P2.
Additionally, you can use P1 as a communication channel for multiple Content Gateway servers in a cluster. In this scenario, P1 cannot be used for outbound traffic. For additional information on clusters, see the Content Gateway Manager Help.
7.
Under Network Agent Interface (N), configure the N interface.
The N interface is used by the Network Agent module. It must be connected to a span (or mirror) port on a switch allowing it to monitor Internet requests going through the switch. (Note: be sure to configure the switch so the span port is monitoring all the ports carrying the traffic of interest; see your switch manufacturer's documentation for configuration instructions). For non-HTTP/HTTPS protocols, the N interface can also be used to send block information to enforce policy.
Note 
The appliance does not send block messages to users who are blocked from non-HTTP and non-HTTPS protocols.
a.
Under Send blocking information for non-HTTP/HTTPS traffic via, select whether non-HTTP/HTTPS blocking information is sent via the C or N interface.
b.
Enter IP address, subnet mask, default gateway (only if you select interface N for sending blocking information), and DNS IP addresses for the N interface.
c.
Click Save in the Network Agent Interface (N) area.
8.
Under Expansion Interfaces (E1 and E2), choose whether to bond to P1 and P2 interfaces. (This applies to the V10000 and V10000 G2 only; E1 and E2 interfaces are not present on the V5000 G2.)
Interfaces E1 and E2 can be cabled to your network and then bonded through software configuration to P1 and P2 (the Websense Content Gateway interfaces). If you choose to bond the interfaces, E1 must be bonded to P1 and E2 to P2. No other pairing is possible.
You can choose to bond or not bond each Websense Content Gateway interface (P1 and P2) independently. You do not have to bond at all. You do not have to bond both. Also, you can choose different bonding modes for P1 and P2 (e.g., P1/E1 could be Active/Standby while P2/E2 could be Load balancing).
a.
Under E1, select the check box for Bond to P1 interface.
*
Active/Standby: Select this for failover. P1 is active, and E1 is in standby mode. Only if the primary interface fails would its bonded interface (E1) become active.
*
Load balancing: Select this for load balancing. If your switch or router supports load balancing, then traffic to and from the primary interface is balanced between the primary interface (P1) and its bonded interface (E1).
c.
Click Save in the Expansion Interfaces (E1 and E2) area.
Follow the instruction above for bonding E1 to P1, substituting E2 in place of E1 and P2 in place of P1. Make sure P2 is enabled. Otherwise the E2 options will be inactive. (See Step 6 for instructions on activating P2.)
a.
In the left navigation pane, click Configuration > Routing.
b.
Under Static Routes, use the Add/Import button to specify customized, static routes.
c.
Under Module Routes, use the Add button to specify non-management Web Security or Email Security traffic through the C interface.
d.
For either static or module routes, use the Delete button to remove existing routes, if necessary.
Note 
An existing route cannot be edited. If you want to edit a route, delete it and then use the Add/Import (static) or Add (module) button to specify the route with the changes you want.
a.
In the left navigation pane, click Configuration > Web Security Components.
*
Choose Full policy source if Websense Policy Broker and Policy Database for your deployment will run on the appliance being configured. (Only one appliance in the network runs these two components, as well as the other filtering components.) Policy Server must also be run on the full policy source appliance; Policy Server can run in multiple locations.
Note 
If Policy Broker runs on an appliance, only on-appliance instances of Policy Server can communicate with Policy Broker. In this case, Policy Server cannot be installed off-appliance. If Policy Broker is installed off-appliance, however, both on-appliance and off-appliance instances of Policy Server can communicate with it.
*
Choose User directory and filtering if the appliance currently being configured is not the location of the policy information, but will run Policy Server and User Service. Then, enter the IP address of the machine running Policy Broker (i.e., the policy source). The policy source can be another appliance that is running in full policy source mode. In this case, enter the IP address of that appliance's C network interface.
*
Choose Filtering only if the appliance being configured will not run any policy components. (There are some disadvantages to this reduced role, as explained in the Appliance Manager Help.) Then, enter the IP address of the machine serving as policy source, which in this case is a machine running Policy Server. The policy source can also be another appliance running in either full policy source or user directory and filtering mode. In this case, enter the IP address of that appliance's C network interface.
c.
Click Save.
a.
b.
Under TRITON - Web Security, select:
*
Off: the TRITON Unified Security Center runs on a separate machine from the appliance.
*
On: the TRITON Unified Security Center runs on this appliance.
TRITON - Web Security is the Web Security module of the TRITON Unified Security Center. For a Websense Web Security Gateway deployment, you can choose to run the TRITON Unified Security Center on or off the appliance.
For other deployments requiring more than the Web Security module of the TRITON Unified Security Center (i.e., Data Security or Email Security modules), the TRITON Unified Security Center must be installed on a separate machine from the appliance. In this case, be sure to disable it here.
Note 
Organizations with high traffic volume or large reporting needs are encouraged to install and run the TRITON Unified Security Center on a separate machine, to optimize performance.
12.
Click Log Off, at the top right, when you are ready to log off Appliance Manager.


Go to the table of contents Go to the previous page Go to the next page Go to the index
Web Security Gateway (appliance-based) > Setting up the appliance