Web Security Gateway Anywhere (appliance-based) > Setting up the appliance

Setting up the appliance

Applies to

Web Security Gateway Anywhere v7.6

V10000 V7.6

V10000 G2 v7.6

V5000 G2 v7.6

In this topic

Overview

Perform initial command-line configuration

Configure the appliance

Overview

Note  If you have already completed the appliance set up steps provided in the Websense V-Series Getting Started guide, skip to Installing off-appliance or optional components now.

The Quick Start poster, which comes in the shipping box with your appliance, shows you all items included in each Websense appliance shipping box. The 2-page Quick Start explains how to set up the hardware and shows how to connect the cables to the appliance and to your network.

Network interface C and the proxy interface (typically P1) must be able to access a DNS server. Both interfaces typically have continuous access to the Internet. Essential databases are downloaded from Websense servers through these interfaces.

Ensure that interfaces C and P1 are able to access the download servers at download.websense.com. (As an alternative, some sites configure the P1 proxy interface to download the Websense Master Database as well as other security updates. In that situation, interface C does not require Internet access.)

Make sure that this address is permitted by all firewalls, proxy servers, routers, or host files that control the URLs that the C and P1 interfaces can access.

After hardware setup, connect directly to the appliance through the serial port or the monitor and keyboard ports. For serial port activation, use:

9600 bits per second

8 data bits

no parity

The activation script, called firstboot, runs when you start the appliance. See next section , for instructions.

Perform initial command-line configuration

The first time you start a Websense appliance, a brief script (firstboot) prompts you to supply settings for the network interface labeled C and a few other general items. You can run the script again if you want to examine your settings or change settings. You can also change settings through the Appliance Manager (browser-based management application) after firstboot has been executed.

Gather the following information before running firstboot. Some of this information may have been written down on the Quick Start during hardware setup.

Hostname
IP address for network interface C
Subnet mask for network interface C
Default gateway for network interface C (IP address) Optional   Note: If you do not provide access to the Internet for interface C, configure: P1 or P2 to download Master URL database updates from Websense (Web Security mode) Configuring these interfaces to access the Internet for database downloads is done through the Appliance Manager and through the TRITON Unified Security Center. See the Appliance Manager Help for information about configuring the interfaces. See the TRTION - Web Security Help for information about configuring database downloads.
Primary DNS server for network interface C (IP address)
Secondary DNS server for network interface C (IP address) Optional
Tertiary DNS server for network interface C (IP address) Optional
Unified password (8 to 15 characters, at least 1 letter and 1 number) This password is for the following: Appliance Manager TRITON - Web Security Content Gateway Manager

When you have gathered the necessary information, run the initial command line configuration, as follows.

1.	Access the appliance through a USB keyboard and monitor or a serial port connection.

Note  To configure the appliance, connect through the serial port or the keyboard/video ports and complete the firstboot script. For serial port activation, use: 9600 bits per second 8 data bits no parity

2.	Accept the subscription agreement when prompted.

3.	When asked if you want to begin, enter yes to launch the firstboot activation script.

NOTE: To rerun the script manually, enter the following command:

firstboot

4.	At the first prompt, select a Web Security only mode:

On a V10000, you are not asked to choose a security mode. The V10000 can run only in Web Security only mode.

5.	Follow the on-screen instructions to provide the information collected above.

After the activation script has been completed successfully, use the Logon Portal to access the Appliance Manager. To reach the Logon Portal, open a supported browser, and enter this URL in the address bar:

http://<IP address>

Replace <IP address> with the address assigned to network interface C during initial configuration of the appliance.

Configure the appliance

The Appliance Manager is the Web-based configuration interface for the appliance. Through it you can view system status, configure network and communication settings, and perform general appliance administration tasks.

After completing the initial configuration required by the firstboot script, use the Appliance Manager to configure important settings for network interfaces N and P1 (and optionally P2), which are used for communications by Network Agent and Websense Content Gateway. Appliance models V10000 and V10000 G2 also offer expansion interfaces (E1 and E2) that can be bonded with P1 and P2, respectively, either for load balancing or standby. Note that on a V5000 G2, there are no E1 and E2 interfaces.

If you use the P2 interface, the P1 interface is bound to eth0, and the P2 interface is bound to eth1. Keep this in mind when you configure Websense Content Gateway. For example, suppose you are using a transparent proxy deployment, and the P1 interface is connected to a WCCP router. In this case, you must configure Websense Content Gateway to use eth0 for WCCP communications (in Content Gateway Manager, see Configure > Networking > WCCP, General tab).

Gather the following information before running the Appliance Manager. Some of this information may have been written on the Quick Start during hardware setup.

Primary NTP server Optional Be sure that interface C can access the NTP server. If interface C does not have Internet access, you can install an NTP server locally on a subnet that can be accessed by interface C.	Domain:
Secondary NTP server Optional	Domain:
Tertiary NTP server Optional	Domain:
IP address for network interface P1	IP address:
Subnet mask for network interface P1	Subnet mask:
Default gateway for network interface P1 and P2 (if used) If both P1 and P2 are used, the default gateway is automatically assigned to whichever interface is in the same subnet with it. If both P1 and P2 are in the same subnet, the default gateway is automatically assigned to P2 (which is bound to eth1).	IP address:
Primary DNS server for network interface P1 and P2 (if used)	IP address:
Secondary DNS server for network interface P1 and P2 (if used) Optional	IP address:
Tertiary DNS server for network interface P1 and P2 (if used) Optional	IP address:
IP address for network interface P2 Required only if P2 is enabled	IP address:
Subnet mask for network interface P2 Required only if P2 is enabled	Subnet mask:
Choose interface for transporting blocking information for non-HTTP and non-HTTPS traffic. (interface C or interface N)	Choose one: C or N
If interface N transports blocking information, N must be connected to a bidirectional span port.	Verify interface N setup.
IP address for network interface N	IP address:
Subnet mask for network interface N	Subnet mask:
Default gateway for network interface N Required only if network interface N carries blocking information	IP address:
Primary DNS server for network interface N	IP address:
Secondary DNS server for network interface N Optional	IP address:
Tertiary DNS server for network interface N Optional	IP address:
Bond expansion interface E1 to P1? Yes or No Optional; V10000 or V10000 G2 only	If Yes, choose one: Active/standby or Load balancing
Bond expansion interface E2 to P2? Yes or No Optional; V10000 or V10000 G2 only	If Yes, choose one: Active/standby or Load balancing
Full policy source IP address	This appliance provides (choose one): Full policy source User directory and filtering (you must specify the IP address of a machine running Policy Broker, which can be a full policy source appliance) Filtering only (you must specify IP address of a machine running Policy Server, which can be a full policy source or user directory and filtering appliance).
TRITON Unified Security Center location (user interface for managing Web Security Gateway) TRITON Unified Security Center can run on this appliance or on a separate Windows server. By default it is enabled to run on the appliance. During the setup procedure below you will decide where it should run. Note: Organizations with high traffic volume or large reporting needs are encouraged to install and run TRITON Unified Security Center on a separate Windows server, to optimize performance.	Choose: runs on this appliance or runs on separate server

After collecting the information needed, access the Appliance Manager through a supported browser.

Follow these steps to enable default proxy caching and filtering. See the Appliance Manager Help for detailed instructions on any field or area, or for information about other available settings.

1.	Open a supported browser, and enter the following URL in the address bar:

https://<IP address>:9447/appmng

Replace <IP address> with the address assigned to network interface C during initial configuration of the appliance.

(See Perform initial command-line configuration.)

2.	Log on with the user name admin and the password set during initial appliance configuration.

3.	In the left navigation pane, click Configuration > System.

4.	Under Time and Date:

a.	Set the time zone.

b.	Set the time and date:

Automatically synchronize with an NTP server: select this option to use a Network Time Protocol server. Specify up to three NTP servers. Use of an NTP server is recommended, to ensure that database downloads and time-based policies are handled precisely.

Manually set time and date: select this option to enter a system time and date yourself.

c.	Click Save in the Time and Date area.

5.	In the left navigation pane, click Configuration > Network Interfaces.

6.	Under Websense Content Gateway Interfaces, configure the P1 and P2 (optional) interfaces.

The P interfaces are used to accept users' Internet requests (inbound traffic) and communicate with Web servers (outbound traffic).

To configure the P interfaces:

a.	Select whether P1 only or both P1 and P2 are used.

If you choose P1 only, enter configuration information (IP address, subnet mask, default gateway, DNS IP addresses) under P1.

If you choose P1 and P2, enter configuration information under both P1 and P2. Note that default gateway and DNS configuration (under Shared Setting) are shared between both P1 and P2.

b.	Click Save in the Websense Content Gateway Interfaces area when you are done.

 

Important  When you use the P2 interface, the P1 interface is bound to eth0, and the P2 interface is bound to eth1. Keep this in mind when you configure Websense Content Gateway. For example, suppose you are using transparent proxy, and the P1 interface is connected to the WCCP router. In this case, you must configure Websense Content Gateway to use eth0 for WCCP communications (in Content Gateway Manager: Configure > Networking > WCCP, General tab).

When only P1 is used, it handles both inbound and outbound traffic for the proxy module (i.e., Content Gateway).

Alternatively, you could use both P1 and P2 such that P1 handles inbound traffic and P2 handles outbound traffic. To enable this configuration, be sure to set appropriate routing rules for P1 and P2 on the Configuration > Routing page. For example, you might set outbound traffic to go through P2.

Additionally, you can use P1 as a communication channel for multiple Content Gateway servers in a cluster. In this scenario, P1 cannot be used for outbound traffic. For additional information on clusters, see the Content Gateway Manager Help.

7.	Under Network Agent Interface (N), configure the N interface.

The N interface is used by the Network Agent module. It must be connected to a span (or mirror) port on a switch allowing it to monitor Internet requests going through the switch. (Note: be sure to configure the switch so the span port is monitoring all the ports carrying the traffic of interest; see your switch manufacturer's documentation for configuration instructions). For non-HTTP/HTTPS protocols, the N interface can also be used to send block information to enforce policy.

Note  The appliance does not send block messages to users who are blocked from non-HTTP and non-HTTPS protocols.

To configure the N interface:

a.	Under Send blocking information for non-HTTP/HTTPS traffic via, select whether non-HTTP/HTTPS blocking information is sent via the C or N interface.

b.	Enter IP address, subnet mask, default gateway (only if you select interface N for sending blocking information), and DNS IP addresses for the N interface.

c.	Click Save in the Network Agent Interface (N) area.

8.	Under Expansion Interfaces (E1 and E2), choose whether to bond to P1 and P2 interfaces. (This applies to the V10000 and V10000 G2 only; E1 and E2 interfaces are not present on the V5000 G2.)

Interfaces E1 and E2 can be cabled to your network and then bonded through software configuration to P1 and P2 (the Websense Content Gateway interfaces). If you choose to bond the interfaces, E1 must be bonded to P1 and E2 to P2. No other pairing is possible.

You can choose to bond or not bond each Websense Content Gateway interface (P1 and P2) independently. You do not have to bond at all. You do not have to bond both. Also, you can choose different bonding modes for P1 and P2 (e.g., P1/E1 could be Active/Standby while P2/E2 could be Load balancing).

Make sure all interfaces are cabled properly before configuring bonding.

To bond E1 to P1:

a.	Under E1, select the check box for Bond to P1 interface.

b.	Under E1/P1 bonding mode, select:

Active/Standby: Select this for failover. P1 is active, and E1 is in standby mode. Only if the primary interface fails would its bonded interface (E1) become active.

Load balancing: Select this for load balancing. If your switch or router supports load balancing, then traffic to and from the primary interface is balanced between the primary interface (P1) and its bonded interface (E1).

c.	Click Save in the Expansion Interfaces (E1 and E2) area.

To bond E2 to P2:

Follow the instruction above for bonding E1 to P1, substituting E2 in place of E1 and P2 in place of P1. Make sure P2 is enabled. Otherwise the E2 options will be inactive. (See Step 6 for instructions on activating P2.)

9.	Configure routes if necessary:

a.	In the left navigation pane, click Configuration > Routing.

b.	Under Static Routes, use the Add/Import button to specify customized, static routes.

c.	Under Module Routes, use the Add button to specify non-management Web Security or Email Security traffic through the C interface.

d.	For either static or module routes, use the Delete button to remove existing routes, if necessary.

Note  An existing route cannot be edited. If you want to edit a route, delete it and then use the Add/Import (static) or Add (module) button to specify the route with the changes you want.

See the Appliance Manager Help for more information about static and module routes.

10.	Select the policy mode of this appliance:

a.	In the left navigation pane, click Configuration > Web Security Components.

b.	Specify the role of this appliance with respect to Websense Web Security policy information.

Choose Full policy source if Websense Policy Broker and Policy Database for your deployment will run on the appliance being configured. (Only one appliance in the network runs these two components, as well as the other filtering components.) Policy Server must also be run on the full policy source appliance; Policy Server can run in multiple locations.

 

Note  If Policy Broker runs on an appliance, only on-appliance instances of Policy Server can communicate with Policy Broker. In this case, Policy Server cannot be installed off-appliance. If Policy Broker is installed off-appliance, however, both on-appliance and off-appliance instances of Policy Server can communicate with it.

Choose User directory and filtering if the appliance currently being configured is not the location of the policy information, but will run Policy Server and User Service. Then, enter the IP address of the machine running Policy Broker (i.e., the policy source). The policy source can be another appliance that is running in full policy source mode. In this case, enter the IP address of that appliance's C network interface.

Choose Filtering only if the appliance being configured will not run any policy components. (There are some disadvantages to this reduced role, as explained in the Appliance Manager help system.) Then, enter the IP address of the machine serving as policy source, which in this case is a machine running Policy Server. The policy source can also be another appliance running in either full policy source or user directory and filtering mode. In this case, enter the IP address of that appliance's network interface C.

c.	Click Save.

11.	Disable TRITON Unified Security Center on this appliance

a.	If you have not done so already, in the left navigation pane, click Configuration > Web Security Components.

b.	Under TRITON - Web Security, select Off.

Web Security Gateway Anywhere requires both the Web and Data Security modules of the TRITON Unified Security Center. TRITON Unified Security Center must be installed off the appliance.

12.	Click Log Off, at the top right, when you are ready to log off Appliance Manager.

Web Security Gateway Anywhere (appliance-based) > Setting up the appliance