Preparing to install Websense Content Gateway


	Note The instructions below are for the most common client browsers. For other client browsers refer to the browser's documentation for instructions on manual explicit proxy configuration.

Configuring Internet Explorer 8.0 and later for explicit proxy

In Internet Explorer, select Tools > Internet Options > Connections > LAN Settings.

Select Use a proxy server for your LAN.

Click Advanced.

For HTTP, enter the Content Gateway IP address and specify port 8080.

For Secure, enter the Content Gateway IP address and specify port 8080.

Clear Use the same proxy server for all protocols.

Click OK to close each screen in this dialog box.

Configuring Firefox 5.x for explicit proxy

In Firefox, select Tools > Options > Advanced, and then select the Network tab.

Select Settings.

Select Manual proxy configuration.

For HTTP Proxy, enter the Content Gateway IP address and specify port 8080.

For SSL Proxy, enter the Content Gateway IP address and specify port 8080.

Click OK to close each screen in this dialog box.

Transparent proxy

In transparent proxy deployments, client requests are intercepted and redirected to Content Gateway, without client involvement, via a WCCPv2-enabled router or Layer 4 switch in your network. In a multiple-proxy (cluster) deployment, a WCCP v2-enabled router also supports load distribution among proxies.

See Content Gateway Manager Help for additional information on configuring a WCCPv2-enabled router or a Layer 4 switch, and about the ARM (Adaptive Redirection Module).

System requirements for Websense Content Gateway

Hardware

Software

Preparing a cache disk for use by Websense Content Gateway

Hardware

CPU

Quad-core running at 2.8 GHz or faster

100 GB for the operating system, Websense Content Gateway, and temporary data.

147 GB for caching
If caching will not be used, this disk is not required.
The caching disk:

Should be at least 2 GB and no more than 147 GB

Must be a raw disk, not a mounted file system

Must be dedicated

Must not be part of a software RAID

Should be, for best performance, a 10K RPM SAS disk on a controller that has at least 64 MB of write-through cache

Network Interfaces

To support transparent proxy deployments


Router	Must support WCCP v2. A Cisco router must run IOS 12.2 or later. Client machines, the destination Web server, and Content Gateway must reside on different subnets.
—or— Layer 4 switch	You may use a Layer 4 switch rather than a router. To support WCCP, a Cisco switch requires the EMI or IP services image of the 12.2SE IOS release (or later). Websense Content Gateway must be Layer 2 adjacent to the switch. The switch must be able to rewrite the destination MAC address of frames traversing the switch. The switch must be able to match traffic based on the layer 4 protocol port (i.e., TCP port 80).

Software

Content Gateway version 7.7.3 and 7.7.4 are certified on all of the Red Hat Enterprise Linux versions that 7.7.0 is certified on, plus:

Update 3, 64-bit, Basic Server

Content Gateway version 7.7.0 is certified on:

Red Hat Enterprise Linux, 6 series, updates 0, 1, and 2, 64-bit, Basic Server

Red Hat Enterprise Linux, 5 series, updates 3, 4 and 5, base or Advanced Platform, 32-bit only

The corresponding CentOS versions (CentOS version numbers have a one-to-one correspondence with Red Hat Enterprise Linux version numbers).

Although not certified, Websense, Inc. provides "best effort" support for newer versions of Red Hat Enterprise Linux. Under "best effort" support, Websense Technical Support makes a best effort to troubleshoot cases in standard fashion unless the issue is deemed a Red Hat Enterprise Linux-specific issue, at which point you must contact Red Hat directly for assistance.

Only kernels shipped with the above Linux versions are supported by Websense Content Gateway. Visit www.redhat.com for kernel information. To display the kernel version installed on your system, enter the command:

/bin/uname -r

For more information on installing on Red Hat Enterprise Linux, see Requirements for Red Hat Enterprise Linux.

Websense Web filtering components

Versions must match. When version 7.7.0 of Content Gateway is used, TRITON – Web Security must be version 7.7.0. When version 7.7.4 is used, TRITON – Web Security must be version 7.7.4.


	Important Websense filtering software must be installed prior to Content Gateway. When the filtering software is installed, Websense Content Gateway must be specified as the integration product. See Installation overview: Web Security Gateway Installing via the Web Security All option or Installation overview: Web Security Gateway Anywhere.

Integration with Websense Data Security

Content Gateway v 7.7.0 must be used with Data Security v7.7.0 to take advantage of the co-located Data Security policy engine.

Content Gateway v7.7.3, v7.7.4, and beyond must work with Data Security v7.7.3.

The order of installation does not matter. Websense Data Security may be installed before or after Content Gateway.

Any v7.7.x version of Content Gateway can be used via the ICAP interface. See Content Gateway Manager Help for configuration instructions.

Web browsers

Content Gateway is configured and maintained with a Web-based user interface called the Content Gateway Manager. Content Gateway Manager supports the following Web browsers:

Internet Explorer 8 and 9

Mozilla Firefox 5 and later

Google Chrome 13 and later


	Note The browser restrictions mentioned above apply only to the Content Gateway Manager and not to client browsers proxied by Content Gateway.

Hostname and DNS configuration for Content Gateway

Configure a hostname for the Content Gateway machine and also configure DNS name resolution. Complete these steps on the machine on which you will install Content Gateway.

Configure the hostname:

hostname <hostname>

where <hostname> is the name you are assigning this machine.


	Important The hostname must be 15 characters or less.

Update the HOSTNAME entry in the /etc/sysconfig/network file:

HOSTNAME=<hostname>

where <hostname> is the same as in Step 1.

Specify the IP address to associate with the hostname in the /etc/hosts file. This should be static and not served by DHCP. The proxy uses this IP address in features such as transparent authentication and hierarchical caching. This must be the first line in the file. Do not delete the second and third lines (the ones that begin with "127.0.0.1" and "::1", respectively).

xxx.xxx.xxx.xxx <FQDN> <hostname>

127.0.0.1 localhost.localdomain localhost

::1 localhost6.localdomain6 localhost6

<FQDN> is the fully-qualified domain name of this machine
(i.e., <hostname>.<subdomain(s)>.<top-level domain>).
For example: myhost.example.com

<hostname> is the same name specified in Step 1.

Do not reverse the order of the FQDN and hostname.

Configure DNS in the /etc/resolv.conf file.

search <subdomain1>.<top-level domain> <subdomain2>.<top-level domain> <subdomain3>.<top-level domain>

nameserver xxx.xxx.xxx.xxx

This example demonstrates that more than one domain can be listed on the search line. Listing several domains may have an impact on performance, because each domain is searched until a match is found. Also, this example shows a primary and secondary nameserver being specified.

Gather this information:

Default gateway (or other routing information)

List of your company's DNS servers and their IP addresses

DNS domains to search, such as internal domain names. Include any legacy domain names that your company might have acquired.

List of additional firewall ports to open beyond SSH (22) and the proxy ports (8080-8090). See Ports.

Preparing a cache disk for use by Websense Content Gateway

For Websense Content Gateway to operate as a caching proxy, it must have access to at least one raw disk. Otherwise, Content Gateway can function as a proxy only.

To create a raw disk for the proxy cache when all disks have a mounted file system:


	Note This procedure is necessary only if you want to use a disk already mounted to a file system as a cache disk for Content Gateway. Perform this procedure before installing Content Gateway.


	Warning Do not use an LVM (Logical Volume Manager) volume as a cache disk.


	Warning The Content Gateway installer will irretrievably clear the contents of cache disks.

Enter the following command at the prompt to examine which file systems are mounted on the disk you want to use for the proxy cache:

df -k

Open the file /etc/fstab and comment out or delete the file system entries for the disk.

Save and close the file.

Enter the following command for each file system you want to unmount:

umount <file_system>

where <file_system> is the file system you want to unmount.

When the Content Gateway installer prompts you for a cache disk, select the raw disk you created.


	Note It is possible to add cache disks after Content Gateway is installed. For instructions, see the Content Gateway Manager Help.

Preparing for a clustered deployment of Websense Content Gateway

If you plan to deploy multiple, clustered instances of Websense Content Gateway (Content Gateway):

Find the name of the network interface you want to use for cluster communication. This must be a dedicated interface.

Find or define a multicast group IP address.


	Note If a multicast group IP address has not already been defined, enter the following at a command line to define the multicast route: route add <multicast.group address>/32 dev <interface_name> where <interface_name> is the name of the interface used for cluster communication. For example: route add 224.0.1.37/32 dev eth1