v5.2 Installation Guide for Websense Enterprise v5.2 Embedded on Cisco Content Engine

Transcription

1 v5.2 Installation Guide for Websense Enterprise v5.2 Embedded on Cisco Content Engine

2 Websense Enterprise Installation Guide , Websense, Inc. All rights reserved Sorrento Valley Rd., San Diego, CA 92121, USA Published September 30, 2004 Printed in the United States of America NP CCO This document may not, in whole or in part, be copied, photocopied, reproduced, translated, or reduced to any electronic medium or machine-readable form without prior consent in writing from Websense, Inc. Every effort has been made to ensure the accuracy of this manual. However, Websense, Inc., makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Websense, Inc. shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice. Trademarks Websense and Websense Enterprise are registered trademarks of Websense, Inc. in the United States and certain international markets. Websense has numerous other unregistered trademarks in the United States and internationally. All other trademarks are the property of their respective owners. Microsoft, Windows NT, Windows 2000, Windows 2003, Windows XP, Internet Explorer, and Active Directory are trademarks or registered trademarks of Microsoft Corporation. Solaris is a registered trademark of Sun Microsystems, Inc., in the United States and other countries. Sun, Sun ONE and all Sun ONE based trademarks and logos are trademarks of Sun Microsystems, Inc. Netscape is a registered trademark of Netscape Communications Corporation in the U.S. and other countries. Netscape Navigator and Netscape Communicator are also trademarks of Netscape Communications Corporation and may be registered outside the U.S. The following is a registered trademark of Novell, Inc., in the United States and other countries: Novell Directory Services. Adobe, Acrobat, and Acrobat Reader are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States and/or other countries. Pentium is a registered trademark of Intel Corporation. Red Hat is a registered trademark of Red Hat, Inc., in the United States and other countries. Linux is a trademark of Linux Torvalds, in the United States and other countries. This product includes software distributed by the Apache Software Foundation ( Copyright (c) The Apache Software Foundation. All rights reserved. Other product names mentioned in this manual may be trademarks or registered trademarks of their respective companies and are the sole property of their respective manufacturers. WinPcap Copyright (c) NetGroup, Politecnico di Torino (Italy) All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. Neither the name of the Politecnico di Torino nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EX- PRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPE- CIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

3 Contents Chapter 1 Introduction How Websense Works Deployment Tasks Documentation Feedback Chapter 2 Network Configuration Websense Enterprise Components Embedded on the Content Engine Installed Separately Websense Deployment Switched Environments Network Address Translation and Network Agent Deployment Directory Services System Requirements User Service Windows Solaris Linux Websense Manager DC Agent Network Agent Windows Linux Real-Time Analyzer User Workstations Chapter 3 Upgrading Websense Upgrading Websense Manager and DC Agent Websense Enterprise 3

4 Contents Chapter 4 Installation and Setup Before Installing Additional Websense Components Installing Additional Websense Components Installing Components Together on Windows Websense Manager Installed Separately Windows User Service Installed Separately Uninstall User Service on the Content Engine Install User Service Separately on a Windows Machine DC Agent Installed Separately on a Windows machine Network Agent Installed Separately Uninstall Network Agent on the Content Engine Install Network Agent Separately CLI Commands on Cisco Content Engine Modifying an Installation Adding Components Windows Solaris or Linux Removing Components Windows Linux Repairing an Installation Windows Solaris or Linux Initial Setup Subscription Key and Database Download HTTP Reporting and Protocol Management Identifying the Filtering Service for the Block Page URL Configuring FireWalls or Routers Browser Access to the Internet Language Pack Translated Block Pages Creating Custom Block Pages Restoring Original Block Pages Embedded on Cisco Content Engine

5 Contents Domain Name System Internet Requests Block Pages DC Agent Configuration File Backups Content Engine Downgrades Before Downgrading Restoring your Websense v5.0.1 System Stopping or Starting Websense Services Windows Windows Linux or Solaris Chapter 5 Configuring the Cisco Content Engine Cisco Web-Based Interface Console or TELNET Session File Management on the Content Engine Command Line Interface (CLI) File Transfer Protocol (FTP) CLI Command Displaying Websense Administrative Status Appendix A Configuring Windows NTLM for User Authentication Configuring the Browser for Promptless Authentication Configuring the Content Engine Configuration and Corresponding Parameters Managing the HTTP Proxy Authentication Cache Query Individual Users for More Information Guarantee Reauthentication Next Day NT Lan Manager (NTLM) User/Group Access Lists Transaction Reporting Appendix B Troubleshooting I forgot my Websense Filtering Service password Where can I find download and error messages? Windows NT Websense Enterprise 5

6 Contents Windows Solaris, Linux, and Cisco Content Engine Websense Master Database does not download Subscription Key Internet Access Restriction Applications There is No Protocol Filtering There is No URL Filtering Appendix C Technical Support Websense Technical Services Support Center Fee-based Support Support Options Web Portal Questions Telephone Assistance Improving Documentation Index Embedded on Cisco Content Engine

7 CHAPTER 1 Introduction Thank you for choosing Websense Enterprise, the leading Employee Internet Management system embedded on the Cisco Application and Content Networking System (ACNS) Content Engine. Websense gives network administrators in business, education, government, and other enterprises the ability to monitor and control network traffic to Internet sites. In the business setting, Websense Enterprise is an invaluable tool for minimizing employee downtime due to Internet surfing that is not work related. In addition, Websense helps control the misuse of network resources and the threat of potential legal action due to inappropriate access. The major components of Websense Enterprise are: Filtering Service interacts with the Cisco Content Engine to provide Internet filtering. Policy Server stores all Websense Enterprise configuration information and communicates this data to other Websense services. User Service allows you to apply filtering policies based on users, groups, domains and organizational units. Websense Manager administrative interface that communicates with the Policy Server to configure and manage the Filtering Service. DC Agent an optional component that transparently identifies users for filtering through a Windows directory service. Network Agent detects HTTP network activity and calculates the number of bytes transferred. It then instructs the Filtering Service to log this information. You must properly configure Network Agent if you want to use the Bandwidth Optimizer, Protocol Management, and enhanced reporting features. Websense Real-Time Analyzer (RTA) displays the real-time status of all the traffic filtered by Websense Enterprise. RTA graphically displays bandwidth information and shows requests by category or protocol. Websense Master Database contains a collection of nearly 4 million Internet sites, representing more than 800 million pages, each categorized by content. Websense Enterprise 7

8 Chapter 1: Introduction Websense Enterprise Reporter a separate program available free of charge with Websense Enterprise. Its Log Server component records Internet activity on your network. Using this log information, Websense Enterprise Reporter can generate a wide variety of reports and charts depicting your network's Internet usage trends. These reports can be used to refine Internet filtering strategies, helping to maximize network resources and employee productivity. Refer to the Websense Enterprise Reporter Administrator s Guide for installation and configuration procedures. How Websense Works The Websense Enterprise Filtering Service is the engine that enforces content filtering. With its flexible, policy based filtering approach, Websense allows you to apply different filtering policies to different clients (users, groups, domains/organizational units, workstations, or networks). When the Cisco Content Engine receives an Internet request from a client, it queries the Filtering Service to find out whether the requested site should be blocked or not. To make this determination, the Filtering Service consults the policy assigned to the client. Each policy defines specific time periods during the week and lists the category sets that are in effect during those time periods. After it determines which categories are blocked, Filtering Service consults its comprehensive database of Internet addresses (URLs). If the site is assigned to a blocked category, the user receives a block page instead of the requested site. If the site is assigned to a permitted category, or belongs to the Miscellaneous Set of sites, Websense Enterprise notifies the Content Engine that the site is not blocked, and the site is returned to the user. Websense Enterprise filters network applications that use TCP-based protocols and provides filtering and logging support for UDP-based messages as well. If an initial Internet request is made with TCP and the request is blocked by Websense Enterprise, all subsequent UDP traffic will also be blocked. UDP protocols such as RTSP and RTP are monitored and logged by Websense Enterprise. If you have purchased the Bandwidth Optimizer, Websense Enterprise with Network Agent can filter Internet sites, protocols, or applications based on available network bandwidth. You can specify filtering settings to limit user access to sites, protocols, or applications based on bandwidth usage. 8 Embedded on Cisco Content Engine

9 Chapter 1: Introduction With the Protocol Management feature, Websense Enterprise can filter Internet protocols other than HTTP, HTTPS, and FTP. This includes protocols, applications, or other data transfer methods such as those used for instant messaging, streaming media, file sharing, file transfer, Internet mail, and various other network or database operations. The quota feature is an alternative to full blocking. It gives employees time each day to visit sites in categories you deem appropriate. Quotas can be a powerful tool for Internet access management. Quotas help you control how much time your employees spend on personal surfing and the types of sites they are able to access. For more information, please refer to the Quotas section in your Websense Enterprise Administrator's Guide. Websense, Inc. strongly recommends that your users be informed of your organization's policies concerning Internet access, and that Websense Enterprise has been installed as a tool for monitoring activity and/or enforcing your Internet use policies. Deployment Tasks The following sequence is recommended for installing Websense Enterprise components and configuring your system to filter Internet traffic with the Cisco Content Engine. 1. Plan the Websense deployment. Websense components can be deployed in various combinations depending upon the size and architecture of your network. Deciding what Websense components to install and where to put them is your first task. Consult Chapter 2: Network Configuration for sample deployment options and to determine the operating systems supported by each Websense Enterprise component. 2. Configure the Content Engine for NTLM authentication: If you are using NTLM authentication, you must disable User Service on the Content Engine so that User Service can be installed as an independent component on a separate Windows machine and you must configure Windows NTLM for user authentication. For details about this type of configuration, refer to Appendix A: Configuring Windows NTLM for User Authentication. 3. Install the Websense Manager and optional Websense Enterprise components. Using the appropriate download file for the operating system, install the Websense Manager on a separate machine in your Websense Enterprise 9

10 Chapter 1: Introduction network. Install optional Websense components on separate machines in your network or together on the same machine as the Manager. Refer to the specific instructions in Chapter 4: Installation and Setup. 4. Perform the initial setup. Setup tasks include: Download the Websense Master Database. Refer to Subscription Key and Database Download, page 64, for instructions on entering your subscription key and downloading the Websense Master Database. Identify the Filtering Service for block pages. Refer to Identifying the Filtering Service for the Block Page URL, page 67, for instructions. Identify Users. Refer to Directory Services, page 19, for instructions on using the supported directory services. Identify upstream. routers and firewalls in Websense Enterprise. Refer to Configuring FireWalls or Routers, page 68, for instructions. Configure workstation browsers. Refer to Browser Access to the Internet, page 68, for instructions on configuring browsers to send Internet requests through the Cisco Content Engine. Documentation Feedback Websense, Inc. welcomes comments and suggestions regarding the product documentation. Please send feedback to If possible, include your organization s name in your message. 10 Embedded on Cisco Content Engine

11 CHAPTER 2 Network Configuration The Filtering Service, Policy Server, and User Service are embedded on the Content Engine. Network Agent is installed manually on the Content Engine. Websense Enterprise Manager and the optional components can be installed in a number of possible configurations, depending upon the nature of your network and your filtering requirements. The information in this chapter will help you determine both your hardware needs and the relationship of Websense Enterprise components to one another. Websense Enterprise Components When deciding how to deploy Websense Enterprise components in your network, consider the following installation dependencies. Embedded on the Content Engine The Websense Enterprise components embedded on the Content Engine are: Websense Filtering Service In very large networks, it may be desirable to install additional Filtering Services on separate Cisco Content Engines to increase efficiency by distributing the load. Policy Server You may install additional Policy Servers depending upon the arrangement of your network. There must be only one Policy Server installed for each logical installation. An example would be a Policy Server that delivers the same policies and categories to each machine in a subnet. Refer to the Websense Enterprise Administrator s Guide for instructions on policy distribution. User Service User Service must be installed in networks using a directory service for authentication. User Service is unnecessary if you intend to filter and log Internet requests based on IP addresses. If you are using a Windows-based directory service, User Service must be disabled on the Content Engine and installed separately on a Windows machine (see page 41). User Service must be installed on a Windows operating system if the DC Agent is being used. You may have only one User Websense Enterprise 11

12 Chapter 2: Network Configuration Installed Separately Service installation for each Policy Server. For systems providing multilingual support, User Service produces correct results for one locale only. The locale of the Policy Server determines the language it supports for directory services. Organizations with multilingual support requirements must install the product suite (User Service, Policy Server, and Filtering Service) for each supported language on machines configured for that language. The Websense Enterprise components that are installed separately are: Websense Manager installs only on Windows machines and may be installed on multiple machines in the network to enable remote configuration of the Filtering Service. Network Agent When planning the deployment of the Network Agent (NA) consider the following: The Network Agent is installed manually on the Content Engine. The Network Agent machine must be able to directly see Internet traffic from your internal network for Network Agent to function effectively. See Switched Environments, page 16, if you are installing Network Agent in a network that employs switches. On larger networks, you may need to install multiple Network Agents and assign them to monitor various IP address ranges in your network. Make sure to deploy the Network Agents so that they can filter the entire network. Partial deployment will result in the loss of log data from network segments not watched by the Network Agent. For instructions on defining IP address ranges for multiple Network Agents, refer to the Websense Enterprise Administrator s Guide. Avoid deploying the Network Agent across different LANs. If you install an instance of Network Agent on 192.x.x.x and configure it to communicate with a Policy Server on 10.x.x.x through a variety of switches and routers, communication may be slowed enough to prevent the Network Agent from blocking an Internet request in time. Do not install the Network Agent on a machine running any type of firewall. The Network Agent uses WinPcap, which may not be able to detect HTTP requests when installed on a firewall machine. Real-Time Analyzer (RTA) installs on Windows only. You must have only one installation of RTA for each Policy Server in your network. 12 Embedded on Cisco Content Engine

13 Chapter 2: Network Configuration To use the RTA Web-based interface, you must have one of the following Web servers installed on the installation machine. Apache version 2.x and later Microsoft IIS v4.0 or v5.0 NOTE If you do not have one of the supported Web servers on your machine, the Websense Enterprise installer will offer you the option of installing Apache. DC Agent should be installed in networks using a Windows directory service (NTLM-based or Active Directory). DC Agent can be installed on any Windows Server in the network, either on the same machine as other Websense components, or a different machine. DC Agent installs on Windows only. For small to medium networks, it is recommended that you install only one DC Agent per domain. If you have a large, distributed network with many domain controllers on the same domain, you can install multiple DC Agents. Installing DC Agent on the domain controller machine is not recommended. DC Agent can be installed on any network segment as long as NetBIOS is allowed between the DC Agent and the domain controllers. Setting up the DC Agent in the DMZ is not recommended. For additional information on the role of DC Agent in user identification, refer to the Websense Enterprise Administrator s Guide. Websense Enterprise Reporter components install on Windows only. The Log Server receives and saves information on Internet requests filtered by Websense Enterprise. Reporter then uses this information to create reports. See the Websense Enterprise Reporter Administrator s Guide for installation and administrative information. NOTE To generate reports properly, you must use the same version of Websense Enterprise and Websense Enterprise Reporter. Websense Enterprise 13

14 Chapter 2: Network Configuration Websense Deployment The following network diagrams represent common configurations that are maximized for efficiency. Separate Websense Enterprise components can be installed on a single server machine or distributed across a network. This architecture may not be suitable for networks containing 1000 or more users. Refer to Websense Enterprise Components, page 11, and System Requirements, page 21, for installation guidelines when planning your deployment. In environments with a large number of workstations, installing multiple Filtering Services for load balancing purposes may be appropriate; however, some load balancing configurations permit the same user to be filtered by different Filtering Services, depending on the current load. For instructions on how to configure Websense for multiple Filtering Services, refer to the Websense Enterprise Administrator s Guide. Typical configurations include networks with a single firewall, proxy server, or caching appliance, and networks with an array of firewalls, proxy servers, or caching appliances. A common network topology places the Content Engine with Websense Enterprise behind the firewall. The Websense Manager, Websense Enterprise Real-Time Analyzer, and DC Agent are installed together on a Windows server machine communicating with the Policy Server on the Content Engine through TCP/IP. You can also install Websense Manager on multiple machines in the network to enable remote configuration of the Policy Server. 14 Embedded on Cisco Content Engine

15 Chapter 2: Network Configuration Firewall or Internet Router Internet Websense Manager DC Agent, and Real- Time Analyzer Directory Service Cisco Content Engine, Filtering Service, Policy Server, User Service, and Network Agent Websense Reporter, Log Server Workstation Workstation Workstation Workstation Websense Enterprise, Network Agent, and Content Engine Behind Firewall Websense Enterprise 15

16 Chapter 2: Network Configuration Switched Environments In a switched environment, configure a switch to use mirroring or 2-way port spanning, so that the Network Agent can detect Internet requests from all the workstations. NOTE Contact your switch vendor to determine if your switch is capable of mirroring or port spanning and to learn how to implement the correct configuration. Internet Switched Environment Requirement: Network Agent must be able to detect traffic coming from all the workstations in the LAN. Traffic from both Switch #1 and Switch #2 go through Switch #3 into the Network Agent machine. Solution: The port on Switch #3 to which the Network Agent machine is connected must be configured to monitor the port to which the traffic from Switch #1 and Switch #2 is connected. The Network Agent can then monitor all Internet traffic from the other network segments. Firewall or Internet Router Content Engine, Filtering Service, Policy Server, User Service, and Network Agent Switch #1 Switch #2 Switch #3 Client Client Client Client Websense Manager, DC Agent, and Real-Time Analyzer Client Client Basic Deployment in a Switched Environment 16 Embedded on Cisco Content Engine

17 Chapter 2: Network Configuration Internet Router #2 What Network Agent Does Remote Office Requirement: The Network Agent must be able to monitor all internal Internet traffic from Switch #1, Switch #2, and Switch #3, as well as the Internet traffic coming into Router #1 from the remote office. Solution: Install an additional switch (Switch #4) between Router #1 and the firewall. Connect the Network Agent to Switch #4. Configure the port to which the Network Agent is connected to monitor the port to which Router #1 is connected. Firewall Switch #4 Network Agent Remote Office Router #1 Switch #1 Switch #2 Switch #3 Client Client Client Client Client Client Client Client Client Switched Environment with a Remote Office Connection Websense Enterprise 17

18 Chapter 2: Network Configuration On a large network, you may need to install multiple Network Agents and assign them to monitor various IP address ranges in your network. If you install multiple Network Agents, consider the following: Do not assign overlapping IP address ranges. If the IP ranges overlap, network bandwidth measurements will not be accurate, and bandwidthbased filtering will not be applied correctly. Deploy the Network Agents so that they can filter the entire network. Partial deployment will result in the loss of log data from network segments not watched by the Network Agent. Internet Multiple Network Agents Requirement: To effectively manage both HTTP and non- HTTP traffic, Network Agent must see all the traffic from all three subnets. Solution: Install an instance of Network Agent on each subnet. Switch #1, Switch #2, and Switch #3 must be configured to allow the port to which the Network Agent is connected to monitor the port to which the Content Engine is connected. Each instance of Network Agent will be configured to monitor all the traffic on its subnet and to communicate with the same Filtering Service installed on the Content Engine. Firewall or Internet Router Content Engine, Filtering Service, Policy Server, and User Service Switch #2 Switch #1 Switch #3 Client Client Client Client Client Client Network Agent Network Agent Network Agent, Websense Manager, DC Agent, Real-Time Analyzer Multiple Network Agents in a Switched Environment 18 Embedded on Cisco Content Engine

19 Chapter 2: Network Configuration Network Address Translation and Network Agent Deployment The use of Network Address Translation (NAT) on internal routers can prevent the Network Agent from identifying the source IP addresses of client machines making Internet requests. If you are deploying the Network Agent to monitor traffic from multiple subnets after it passes through such a router, you must disable NAT, or the Network Agent will see the IP address of the router's external interface as the source of the request. An alternative would be to install the Network Agent on a machine located between the NAT router and the clients to be monitored. Directory Services If your environment includes a directory service, you may also assign different policies to individual users or groups with accounts in that directory service. Websense can communicate with the following directory services: Windows NTLM-based directories Windows Active Directory SunONE Directory Server v4.2 and v5.1 For information about configuring directory service access, see your Websense Enterprise Administrator s Guide. Websense Enterprise can communicate with your directory service whether it runs on the same operating system as Websense Enterprise or on a different system. If your directory service is Windows-based, you must disable User Service on the Content Engine and install the Websense User Service on a Windows machine. This enables User Service to communicate with the Windows-based directory service. For instructions on disabling User Service on the Content Engine, refer to page 41. Filtering can be based on individual user, group, and domain/organizational unit policies, providing that Websense Enterprise is able to identify the user making an Internet request. The authentication method you configure must allow the Filtering Service to obtain directory object information from a Windows or LDAP directory. For information about accessing LDAP and Windows directories, see the Websense Enterprise Administrator s Guide. Websense can use LDAP expressions to classify users for filtering purposes. You can create named groups of users based on any LDAP attribute in your directory service, and add these groups to Websense Manager. For Websense Enterprise 19

20 Chapter 2: Network Configuration information about defining groups of users based on LDAP attributes, see the Websense Enterprise Administrator s Guide. NOTE In any environment, Websense can filter based on workstation or network policies. Workstations are identified within Websense by their IP addresses, and networks are identified as IP address ranges. Internet requests can be filtered based on policies assigned to individual directory objects after the following tasks have been accomplished: If you are using the SunONE or Novell directory service: 1. Enable the appropriate directory service within Websense Enterprise. 2. Enable Websense manual authentication so that Websense Enterprise can identify users. If you are using a Windows NTLM-based directory or Active Directory: 1. Configure the Windows directory service within Websense Enterprise. 2. Enable Websense Enterprise to identify users transparently by installing and configuring the Websense DC Agent. 3. Enable manual authentication within Websense Enterprise so that if Websense Enterprise is unable to identify users transparently, it will prompt users to manually authenticate. For information about Websense Enterprise manual authentication, see the Websense Enterprise Administrator s Guide. 4. Disable User Service on the Cisco Content Engine and install it on a Windows machine in your network. User Service may be installed separately or together with other Websense Enterprise components. For instructions on disabling User Service on the Cisco Content Engine and installing it separately, refer to page 41. Websense Enterprise can transparently identify users in a Windows domain if the DC Agent is installed on a Windows NT or Windows 2000 Server in the network. The Websense Enterprise transparent identification feature allows Websense Enterprise to filter Internet requests from users identified in a Windows directory without prompting them to manually authenticate. Once the Websense Filtering Service is configured to communicate with DC Agent, DC Agent obtains user information from a Windows-based directory 20 Embedded on Cisco Content Engine

21 Chapter 2: Network Configuration service and sends it to the Filtering Service. When the Filtering Service receives the IP address of a machine making an Internet request, the Filtering Service matches the address with the corresponding user name provided by the DC Agent. This allows Websense Enterprise to transparently identify users whenever they open a browser that sends Internet requests. For information about transparent identification and the DC Agent, please see the Websense Enterprise Administrator s Guide. System Requirements The supported versions of the Cisco Content Engine appliances installed with Websense Enterprise and Content Engine network modules are: 500 Series 7300 Series System requirements are listed separately for the Websense Enterprise components not embedded on the Cisco Content Engine, or installed separately. User Service User Service must be installed on a Windows machine if a Windows directory service is in use. Network Agent runs on Windows and on the Cisco Content Engine, which runs on Linux. Multiple instances of Network Agent may be installed in larger networks. Websense Manager runs on Windows machines. DC Agent runs on Windows only. Real-Time Manager runs on Windows only. User Service can be run on Solaris and on the Cisco Content Engine, which runs on Linux operating systems, but must be run on a Windows operating system when the DC Agent is used. System requirements are listed separately for Windows, Solaris, and Linux. Windows Pentium II or higher 512 MB RAM or more Websense Enterprise 21

22 Chapter 2: Network Configuration Solaris Supported operating systems: Windows NT 4.0 Server, Service Pack 6a Microsoft Windows 2000 Server, Service Pack 2 and higher Sun Ultra SPARC II 512 MB RAM or more One of the following Sun Operating Environments: Solaris 9 Solaris 8 with all the following patches applied Solaris 7 with all the following patches applied: Optional Can only be installed on Chinese language operating systems Solaris 2.6 with all the following patches applied: Embedded on Cisco Content Engine

23 Chapter 2: Network Configuration Linux Optional Required for Euro support Required for Euro support Required for traditional Chinese fonts Pentium III or higher (800 MHz) 512 MB RAM (or more) Red Hat Linux version 7.1, 7.2, 7.3, 8.0, and 9.0 Websense Manager IMPORTANT Make sure you use the download for Websense Enterprise Manager v5.2, which is compatible with the current version of Cisco ACNS. Websense Manager is supported in Windows. Pentium II or higher 256 MB RAM (or more) Supported operating systems: Windows 98 (with updated Microsoft Virtual Machine) Windows Millennium Edition Windows XP Professional Windows 2000 Professional or Server, Service Pack 2 and higher Web browser with Java support enabled (required to view online Help) Color depth set to 8 bit (256 colors) or greater 60 MB of disk space Websense Enterprise 23

24 Chapter 2: Network Configuration DC Agent The DC Agent runs on Windows machines only. Network Agent Pentium II or higher 256 MB of RAM Supported operating systems: Windows NT 4.0 (Server version) Service Pack 6a Microsoft Windows 2000 (Server version), Service Pack 2 and higher The Network Agent is installed manually on the Cisco Content Engine. Network Agent can also be installed separately on Windows or Linux machines. For the most reliable performance, install Network Agent on an Ethernet network. The supported versions of the Cisco Content Engine preinstalled with Websense Enterprise are: 500 Series Windows Linux Pentium II or higher 256 MB of RAM Supported operating systems: Windows NT 4.0 (Server version) Service Pack 6a Microsoft Windows 2000 (Server version), Service Pack 2 and higher Pentium III or higher (800 MHz) 512 MB RAM (or more) Red Hat Linux version 7.1, 7.2, 7.3, 8.0, and 9.0 Real-Time Analyzer The Real-Time Analyzer runs on Windows machines only: 24 Embedded on Cisco Content Engine

25 Chapter 2: Network Configuration Pentium II or higher 256 MB of RAM Supported operating systems: Windows NT 4.0 (Server version) Service Pack 6a Microsoft Windows 2000 (Server version), Service Pack 2 and higher To install and run the Real-Time Analyzer, you must have one of the following supported Web servers installed: Apache version 2.x and higher Microsoft IIS version 4.0 and 5.0 NOTE If you do not have one of the supported Web servers on your system, the Websense Enterprise installer will offer you the option of installing Apache. User Workstations To be filtered by Websense, a user workstation must access the Internet through the Cisco Content Engine. Websense Enterprise 25

26 Chapter 2: Network Configuration 26 Embedded on Cisco Content Engine

27 CHAPTER 3 Upgrading Websense Upgrading from an earlier version of Websense Enterprise is done automatically when you upgrade your Cisco Content Engine operating system. Websense Enterprise v5.2 is part of the ACNS v5.2 image. You must manually install the Network Agent on the Content Engine. You must also upgrade any Websense Enterprise components installed remotely. Refer to Chapter 4: Installation and Setup for procedures on separately installing and configuring additional or optional components. Upgrading Websense Manager and DC Agent After upgrading your Content Engine to v5.2, you must upgrade earlier versions of remotely installed Websense Enterprise components (Websense Manager, User Service, and DC Agent) to v5.2. You may upgrade these components with the main Websense Enterprise installer or with separate Windows installers. IMPORTANT Do not attempt to upgrade either Websense Manager or DC Agent using a separate installer, if these components are running on the same machine. Attempting to upgrade one component only in the presence of another can corrupt the files of the component not being upgraded. The main Websense Enterprise installer was used in these procedures to upgrade both Websense Manager and DC Agent running on the same machine. Refer to Chapter 4: Installation and Setup for procedures on separately installing and configuring additional or optional components. Websense Enterprise 27

28 Chapter 3: Upgrading Websense IMPORTANT Websense Manager v5.2 is the only version that is compatible with Websense Enterprise v5.2 embedded on the Cisco Content Engine. To upgrade Websense Manager and DC Agent: 1. Log on to the installation machine with domain and local administrator privileges. This will upgrade DC Agent with administrator privileges on the domain. IMPORTANT DC Agent must have administrator privileges on the network to retrieve user login information from the domain controller. Without this information, Websense Enterprise cannot filter by users and groups. If you cannot install DC Agent with such privileges, you may configure administrator privileges for this services after installation by using the Services Properties dialog box. 2. Close all open applications. 3. Stop all Websense services manually. If these services have run uninterrupted for several months, they can take a considerable amount of time to stop and may cause the upgrade process to time out. 4. Go to The Free Downloads for New Customers page is displayed. If your subscription key is used for more than the on-box solution for Cisco Content Engine, proceed with the new customer software evaluation download to make your software selection. If your subscription key is specifically for the on-box Cisco Content Engine solution, proceed to Step 6 to upgrade. 5. In the Websense Enterprise Software & Evaluation Key Download section, select the following to upgrade the Websense Enterprise and its components to the most recent version of your ACNS Content Engine. 28 Embedded on Cisco Content Engine

29 Chapter 3: Upgrading Websense a. Click An on-box Websense Enterprise solution? to affirm that you are selecting an on-box solution for your Cisco Content Engine. b. From the drop-down list in this selection, choose Websense Enterprise v5.2 Embedded on Cisco Content Engines Edition. c. Read the Subscription Agreement and check to agree. d. Enter your business address, and then click Continue to begin the download process. e. Proceed to Step 9 to upgrade your version of the Websense Enterprise software and its components. 6. From the main menu, select Download > For Current Customers. 7. In the menu bar at Select the primary purpose for your visit, language to be used in the software, and software components to be installed: Websense Enterprise Manager and Websense Enterprise DC Agent, and then click Continue. 8. Download Websense Manager (WebsenseManager_5.2.exe) and DC Agent (WebsenseDCAgent_5.2.exe). 9. Extract the compressed files to a folder on the installation machine. Setup.exe runs automatically after the files are uncompressed. 10. Follow the onscreen instructions and click Next to advance through the welcome screen and the subscription agreement. Websense Setup detects the Websense Enterprise components from your earlier version and asks you how you want to proceed. You can upgrade the current system or quit the installer. 11. Select Upgrade Websense Enterprise and click Next. A warning is displayed advising you to upgrade any other Websense modules that may have a dependency on the system you are upgrading. This will prevent conflicts caused by incompatible versions. 12. Click Next to continue. The installer asks you to provide a port number for the DC Agent. If the port you select is in use, you are required to select another port before you can continue. 13. Enter a port number for DC Agent or accept the default and click Next. The installer asks if you want an authenticated connection between the User Service and the DC Agent. If you select Yes, you are asked to create a password for the authenticated connection. Websense Enterprise 29

30 Chapter 3: Upgrading Websense 14. Click Next to continue. The installer compares the system requirements for the installation you have selected with the resources of the installation machine. If the machine has inadequate disk space or memory, an information screen is displayed detailing the deficiencies. 15. Click Next to continue. If the installation machine has insufficient disk space, the selected components cannot be installed, and the installer will quit. If the installation machine has less than the recommended amount of memory, the installation will continue. To ensure the best performance of the components you are installing, you should upgrade your machine s memory to the recommended minimum. A summary screen is displayed, listing the components that will be installed, the installation path, and the total size of the installation. 16. Click Next to begin the installation. 17. An installation progress bar is displayed. When the installation is finished, a message is displayed advising you that the procedure was successful. 18. Click Next to continue. A dialog box is displayed asking you if you want to restart the computer now or wait until later. 19. Select a restart option and click Finish. Note You must restart the machine before the installer can be run again. Proceed to Chapter 4: Installation and Setup for installation procedures for the new Websense Enterprise components. 30 Embedded on Cisco Content Engine

31 CHAPTER 4 Installation and Setup This chapter contains instructions for installing Websense Enterprise components on separate machines in your network. Included are the procedures for configuring Websense Enterprise on the Content Engine, the initial setup procedures for downloading the Websense Master Database, and the steps for preparing Websense Enterprise to filter with the Content Engine. Before Installing Additional Websense Components Please read the following information before installing Websense Enterprise components. Foreign language versions: Websense Enterprise v5.2 installs in English only. Websense Enterprise Language Packs for converting systems to foreign language versions are released separately from Websense Enterprise. Installation instructions are provided with the Websense Enterprise Language Pack product. You can download the Websense Enterprise Language Pack from the Websense Web site at: Reporting: To properly generate reports, you must use the same version of Websense Enterprise and Websense Enterprise Reporter and Explorer. Deployment: The following Websense Enterprise components are already installed together on the Content Engine: Filtering Service Policy Server User Service Network Agent must be manually installed on the Content Engine. The following components can be distributed across your network or installed together on a Windows machine: Websense Manager User Service DC Agent Websense Enterprise 31

32 Chapter 4: Installation and Setup Network Agent Real-Time Analyzer You can install these components together or separately by performing a Custom installation with the Websense Enterprise installer. Separate installers are available from the Websense Web site for Websense Manager, Network Agent, and DC Agent. IMPORTANT If you are using a Windows-based directory service, User Service must be disabled on the Content Engine and installed separately on a Windows machine. See page 41 for details. LDAP directory: If your directory service information resides in an LDAP directory, Websense Enterprise users will need LDAP-related information such as the LDAP server IP address and port, base domain, and LDAP cache from the records.config file, which is found in the records. Network Interface Cards (NIC): If you anticipate having to add a second NIC to a machine on which you plan to install the Network Agent, do so before installing the Network Agent. If the NIC is added after Network Agent is installed, you must perform extra procedures to reconfigure Network Agent. Installing Additional Websense Components To configure and manage the Policy Server located on the Cisco Content Engine, you must install the Websense Manager on a Windows machine in your network. You may install the Websense Manager together with other Websense Enterprise components (Installing Components Together on Windows, page 33) or separately (Websense Manager Installed Separately, page 40). Optional components such as DC Agent, additional instances of Network Agent, and Real-Time Analyzer can be distributed in your network or installed on the same Windows machine as the Websense Manager. You can use different combinations of installers to accomplish this depending upon how you intend to distribute the components. The recommended installation is to put all the additional components on a single Windows machine. 32 Embedded on Cisco Content Engine

33 Chapter 4: Installation and Setup User Service can be deployed remotely if necessary. User Service must be installed on a Windows machine when an NTLM-based directory service is used, and additional instances of Network Agent can be installed for load balancing purposes in larger networks. Installing Components Together on Windows To install Websense Manager, DC Agent, and Real-Time Analyzer together on the same Windows machine: 1. Log on to the installation machine with domain and local administrator privileges. This will install DC Agent with administrator privileges on the domain. IMPORTANT DC Agent must have administrator privileges on the network to retrieve user login information from the domain controller. Without this information, Websense Enterprise cannot filter by users and groups. If you cannot install these components with such privileges, you may configure administrator privileges for these services after installation by using the Services Properties dialog box. 2. Download the WebsenseEnterprise_5.2.exe file containing the Websense Enterprise installer. 3. Double-click the.exe file to extract the compressed files to a folder on the installation machine. IMPORTANT Do not extract the installer files to a folder on your desktop. This may prevent the Real-Time Analyzer from receiving the IP address of the Policy Server machine. Accept the default location of C:\Temp or select another appropriate folder. 4. Close all open applications. 5. Run Setup.exe. Websense Enterprise 33

34 Chapter 4: Installation and Setup 6. Click Next on the welcome screen and follow the onscreen instructions through the subscription agreement. You are asked to select an installation. 7. Select Websense Enterprise v5.2 and click Next. 8. You are offered a choice of three setup types. Installation Selection Screen 9. Select Custom and click Next. A list of Websense Enterprise components is displayed. 10. Select Websense Manager, Real-Time Analyzer, and DC Agent. NOTE Make sure to clear the check boxes for the components you do not want to install. 34 Embedded on Cisco Content Engine

35 Chapter 4: Installation and Setup Component Selection Screen 11. Click Next to continue. The installer checks your system for a supported Web server (Apache or IIS) and takes the following action: If both supported Web servers are detected, a dialog box is displayed asking you to choose one server for the Real Time Analyzer (RTA) instance. If one of the supported servers is detected, the installer accepts that Web server for the RTA instance and continues. No notification is displayed. If neither supported Web server is detected, the installer gives you the option to install the Apache Web server or continue the upgrade without installing RTA. If you select the Apache Web Server installation option, the Websense installer starts the Apache installer and exits without installing any Websense Enterprise components. You must restart your computer after installing the Apache Web server and run the Websense Enterprise installer again to perform the Websense Enterprise installation. Websense Enterprise 35

36 Chapter 4: Installation and Setup RTA Web Server Dialog Box NOTE Apache documentation is installed in HTML format in the docs/manual/ directory. The latest version can be found at: Select a Web server option, if appropriate, and then click Next to continue. You are asked to identify the IP address of the machine on which the Policy Server is installed and the configuration port. The configuration port is the port used by Websense Enterprise components to communicate with the Policy Server. IMPORTANT The configuration port (55806) in this dialog box is the default port number used by the installer to install the Policy Server. If you installed the Policy Server using a different port number, enter that port in this dialog box. 36 Embedded on Cisco Content Engine

37 Chapter 4: Installation and Setup Policy Server Machine Identification 13. Enter the IP address of the Content Engine and click Next. A screen is displayed asking you to select the network interface card (NIC) that you want to use for capturing traffic. All network interface cards enabled in the machine appear in a list. 14. Select the desired card and click Next to continue. NOTE If only one NIC is displayed on the screen, you must select it to continue with the installation. The installer asks you to identify the machine on which the Filtering Service is installed. 15. Enter the IP address of the Content Engine and the correct filter port for the Filtering Service if it differs from the default port number supplied. 16. Click Next to continue. The installer asks for a port number for the DC Agent. 17. Accept the default (or enter a different one if this port is already being used on your network) and click Next. Websense Enterprise 37

38 Chapter 4: Installation and Setup A dialog box is displayed asking if you want an authenticated connection between the User Service and the DC Agent. 18. Select Yes or No, and then click Next. If you select Yes, you are asked to create a password for the authenticated connection. Follow the onscreen instructions and click Next to continue. A dialog box is displayed, asking you to select an installation folder for the Websense Enterprise components. 19. Accept the default path (C:\Program Files\Websense), or click Browse to locate another installation folder, and then click Next to continue. The installer compares the system requirements for the installation you have selected with the resources of the installation machine. If the machine has inadequate disk space or memory, an information screen is displayed detailing the deficiencies. 20. Click Next to continue. If the installation machine has insufficient disk space, the selected components cannot be installed, and the installer will quit. If the installation machine has less than the recommended amount of memory, the installation will continue. To ensure the best performance of the components you are installing, you should upgrade your machine s memory to the recommended minimum. A summary screen is displayed, listing the components that will be installed. Below this list is the total size of the installation. 21. Click Next to start the installation. An installation progress bar is displayed. If you are installing the Real-Time Analyzer and are using IIS as your Web server, you are prompted for the name of the Web site in the IIS Manager under which the installer should create a virtual directory. The default value is Default Web Site, which is correct in most instances. IMPORTANT If you have renamed the default Web site in the IIS Manager or are using a language version of Windows other than English, you must enter a value in the Web site name field that matches an existing Web site name in the IIS Manager. 38 Embedded on Cisco Content Engine

39 Chapter 4: Installation and Setup To enter the correct name of your default Web site (if it is different from Default Web Site), type or paste the desired Web site name into the input field exactly as it appears in the IIS Manager. To open the IIS Manager and enter the correct name of your default Web site: a. From the Windows Control Panel, open Administrative Tools. b. Double-click Internet Services Manager. The IIS control screen is displayed c. Expand the tree under your computer name to view available Web site names. d. Right-click on a Web site in which the installer should create the virtual directory and select Properties from the pop-up menu. IIS Manager Locating the Default Web Site e. Copy the name of the Web site from the Description field to the clipboard. f. Close the IIS Manager. g. Return to the Virtual Directory screen in the Websense installer and replace Default Web Site with the name from the IIS Manager. h. Click Next to continue the installation. Websense Enterprise 39

40 Chapter 4: Installation and Setup If you do not have Acrobat Reader (or the full version of Adobe Acrobat) installed on this machine, a screen is displayed reminding you that you must have Acrobat Reader to access the documentation. A link to the appropriate Adobe download site is displayed. A message is displayed advising you that the installation was successful. 22. Click Next to continue. A dialog box is displayed asking if you want to restart the computer now or wait until later. 23. Select a restart option and click Finish. NOTE You must restart the machine before the installer can be run again to remove or add components or to repair an installation. Websense Manager Installed Separately Windows Websense Enterprise v5.2 embedded on the Cisco Content Engine supports the Windows versions of the Websense Manager. A separate installer is available for installing Websense Manager on Windows. To install Websense Manager on a Windows machine: 1. Log in with local administrator privileges to the installation machine. 2. Close all open applications. 3. Download the Websense Manager installation program (WebsenseManager_5.2.exe) from The program is also available on the Websense CD. 4. Run WebsenseManager_5.2.exe. The WinZip Self-Extractor dialog box is displayed. 5. Select a destination folder for the extracted files, and click the Unzip button to expand the installation files. Setup.exe runs automatically when the installation files have decompressed. 6. Follow the onscreen instructions through the subscription agreement. 40 Embedded on Cisco Content Engine

41 Chapter 4: Installation and Setup A dialog box is displayed, asking you to select an installation folder for the Websense Enterprise components. 7. Accept the default path (C:\Program Files\Websense), or click Browse to locate another installation folder, and click Next to continue. The installer compares the system requirements for the installation you have selected with the resources of the installation machine. If the machine has inadequate disk space or memory, an information screen is displayed detailing the deficiencies. If the installation machine has insufficient disk space, the selected components cannot be installed, and the installer will quit. If the installation machine has less than the recommended amount of memory, the message is advisory only, and you can click Next to continue. To ensure the best performance of the components you are installing, you should upgrade your machine s memory to the recommended minimum. A summary screen is displayed, listing the components that will be installed, the installation path, and the total size of the installation. 8. Click Next to start the installation. An installation progress bar is displayed. When the installation is finished, a message is displayed advising you that the procedure was successful. 9. Click Next to exit the installer. User Service Installed Separately If you are using a Windows NTLM-based directory service, you must first disable User Service on the Content Engine, and then install a separate instance of User Service on a Windows machine in your network. Uninstall User Service on the Content Engine To disable User Service on the Content Engine, you must uninstall User Service, and then proceed to install User Service separately on a Windows machine. 1. Enter the following command in the Cisco command line interface: to remove User Service from the Content Engine. dev-ce507 (config)# no websense-server service user activate Websense Enterprise 41

42 Chapter 4: Installation and Setup 2. Type Exit to exit configuration mode. 3. Write to memory to permanently save the change. Install User Service Separately on a Windows Machine You may install User Service separately on a Windows machine, or together with the other components in the recommended Windows installation (page 33). To install User Service separately on a Windows machine: 1. Log in with domain and local administrator privileges to the installation machine. This will install User Service with administrator privileges on the domain. IMPORTANT User Service must have administrator privileges on the network to retrieve user login information from the domain controller. Without this information, Websense Enterprise cannot filter by users and groups. If you cannot install these components with such privileges, you may configure administrator privileges for these services after installation by using the Services Properties dialog box. 2. Download the Websense Enterprise installation program (WebsenseManager_5.2.exe) from downloads. The program is also available on the Websense CD. 3. Run WebsenseManager_5.2.exe. The WinZip Self-Extractor dialog box is displayed. 4. Select a destination folder for the extracted files, and then click the Unzip button to expand the installer files. 5. Close all open applications. 6. Run the Setup.exe file and follow the onscreen instructions through the subscription agreement. 7. Select Websense Enterprise v5.2, when asked for an installation type and click Next. 8. Select Custom when asked for a setup type and click Next. 42 Embedded on Cisco Content Engine

43 Chapter 4: Installation and Setup 9. Select User Service from the list of components to install. NOTE Make sure to clear the check boxes for all the other components. 10. Click Next to continue. You are asked to identify the IP address of the machine on which the Policy Server is installed and the configuration port to use. IMPORTANT The default configuration port (55806) is the port number assigned to the Policy Server on the Content Engine. Do not change the port number in this dialog box. 11. Enter the IP address of the Policy Server machine and click Next. A dialog box is displayed, asking you to select an installation folder for the Websense Enterprise components. 12. Accept the default path (C:\Program Files\Websense), or click Browse to locate another installation folder, and click Next to continue. The installer compares the system requirements for the installation you have selected with the resources of the installation machine. If the machine has inadequate disk space or memory, an information screen is displayed detailing the deficiencies. If the installation machine has insufficient disk space, the selected components cannot be installed, and the installer will quit. If the installation machine has less than the recommended amount of memory, the message is advisory only, and you can click Next to continue. To ensure the best performance of the components you are installing, you should upgrade your machine s memory to the recommended minimum. A summary screen is displayed, listing the components that will be installed, the installation path, and the total size of the installation. 13. Click Next to start the installation. An installation progress bar is displayed. Websense Enterprise 43

44 Chapter 4: Installation and Setup A message reminds you that Protocol Management and Bandwidth Optimizer cannot be used unless Network Agent is installed on a machine with direct access to Internet traffic. Click OK to continue. If you do not have Acrobat Reader (or the full version of Adobe Acrobat) installed on this machine, a screen is displayed reminding you that you must have Acrobat Reader to access the documentation. A link to the appropriate Adobe download site is displayed. When the installation is finished, a message is displayed advising you that the procedure was successful. 14. Click Next. A dialog box is displayed asking you if you want to restart the computer now or wait until later. 15. Select a restart option and click Finish. NOTE You must restart the Windows machine before the installer can be run again. DC Agent Installed Separately on a Windows machine DC Agent must be installed if you are using a Windows directory service. If your network is large, you may benefit from installing DC Agent on multiple machines. This way, you will have ample space for DC Agent files that are continually populated with user information. See page 13 for additional information. DC Agent installs on Windows only. To install DC Agent: 1. Log in with domain and local administrator privileges to the installation machine. This will install User Service and DC Agent with administrator privileges on the domain. 44 Embedded on Cisco Content Engine

45 Chapter 4: Installation and Setup IMPORTANT User Service and DC Agent must have administrator privileges on the network to retrieve user login information from the domain controller. Without this information, Websense Enterprise cannot filter by users and groups. If you cannot install these components with such privileges, you may configure administrator privileges for these services after installation by using the Services Properties dialog box. 2. If needed, download the DC Agent installation program (WebsenseDCAgent_5.2.exe) from downloads. The program is also available on the Websense CD. 3. Run WebsenseDCAgent_5.2.exe. The WinZip Self-Extractor dialog box is displayed. 4. Select a destination folder for the extracted files, and then click the Unzip button to expand the installer files. 5. Close all open applications. 6. Run the Setup.exe file and follow the onscreen instructions through the subscription agreement. 7. Enter the IP and Port numbers for the Policy Server. 8. The Directory Access screen prompts you to enter the domain\user and password. A dialog box is displayed, asking you to select an installation folder for the Websense Enterprise components. 9. Accept the default path (C:\Program Files\Websense), or click Browse to locate another installation folder, and click Next to continue. The installer compares the system requirements for the installation you have selected with the resources of the installation machine. If the machine has inadequate disk space or memory, an information screen is displayed detailing the deficiencies. 10. Click Next to continue. If the installation machine has insufficient disk space, the selected components cannot be installed, and the installer will quit. Websense Enterprise 45

46 Chapter 4: Installation and Setup If the installation machine has less than the recommended amount of memory, the installation will continue. To ensure the best performance of the components you are installing, you should upgrade your machine s memory to the recommended minimum. A summary screen is displayed, listing the components that will be installed, the installation path, and the total size of the installation. 11. Click Next to start the installation. An installation progress bar is displayed. When the installation is finished, a message is displayed advising you that the procedure was successful. 12. Click Next to exit the installer. 13. Configure Filtering Service to communicate with DC Agent by following the instructions for identifying users in the Websense Enterprise Administrator s Guide. Network Agent Installed Separately If you are using a Windows NTLM-based directory service, you must first disable Network Agent on the Content Engine and then install a separate instance of Network Agent on a Windows machine in your network. Uninstall Network Agent on the Content Engine To disable Network Agent on the Content Engine you must uninstall Network Agent, and then proceed to install Network Agent separately on a Windows machine. 1. Enter the following command in the Cisco command line interface: to remove User Service from the Content Engine. dev-ce507 (config)# no websense-server service network-agent activate 2. Type Exit to exit configuration mode. 3. Write to memory to permanently save the change. Install Network Agent Separately The machine on which Network Agent is being installed must directly see internal Internet traffic. If this is part of a multiple deployment of the Network Agent (for load balancing purposes), you must be sure that the IP address ranges for each instance of the Network Agent do not overlap. For 46 Embedded on Cisco Content Engine

47 Chapter 4: Installation and Setup instructions on setting IP address ranges, refer to the Websense Enterprise Administrator s Guide. IMPORTANT The Websense Policy Server and the Filtering Service must be installed and running prior to installing the Network Agent. The installer asks for the IP addresses and port numbers of these components and will not install the Network Agent if the Policy Server and Filtering Service cannot be located. To install Network Agent: 1. Log on to the installation machine with local administrator privileges. 2. Download the Network Agent installation program (WebsenseNetworkAgent_5.2.exe) from downloads. The program is also available on the Websense CD. 3. Run WebsenseNetworkAgent_5.2.exe. The WinZip Self-Extractor dialog box is displayed. 4. Select a destination folder for the extracted files, and then click the Unzip button to expand the installer files. 5. Close all open applications. 6. Run the installation program (Setup.exe) from the unzipped files. 7. Click Next on the welcome screen and follow the onscreen instructions through the subscription agreement. You are asked to identify the machine on which the Policy Server is installed. IMPORTANT The default configuration port (55806) is the port number assigned to the Policy Server on the Content Engine. Do not change the port number in this dialog box. Websense Enterprise 47

48 Chapter 4: Installation and Setup Policy Server Machine Identification 8. Enter the IP address of the Policy Server machine and click Next. You are asked for the port numbers for this instance of the Filtering Service. The range of valid port numbers is from 1024 to If a port you select is in use, you are required to select another port before you can continue. Keep the default port settings, if possible. Changing them may require you to change your integration partner configuration. The Filter port receives requests from the Content Engine and from the Network Agent. The Message port delivers the block pages to the workstation browsers. 48 Embedded on Cisco Content Engine

49 Chapter 4: Installation and Setup Filtering Service Port Settings 9. Accept the default or select valid port numbers, and then click Next to continue. A screen is displayed asking you to select the network interface card (NIC) that you want to use for capturing traffic. All network interface cards enabled in the machine appear in a list. 10. Continue with the installation or exit Setup. Select Continue installation if you are sure that your NIC is able to monitor all targeted Internet traffic. This will install the Network Agent. Select Exit Setup if the visibility test fails. You must either reposition the machine in the network, select another machine on which to install the Network Agent, or install a different NIC. 11. Click Next to continue. The installer asks you if the Network Agent is being installed on a machine that is acting as a firewall. Network Agent cannot function properly on a machine running a firewall. 12. Select Yes or No, and then click Next to continue. Select No if the installation machine is not being used as a firewall. Installation will continue. Websense Enterprise 49

50 Chapter 4: Installation and Setup Select Yes if you are attempting to install Network Agent on a firewall machine, and Setup will close. Continue the Network Agent installation on a machine that is not running a firewall. 13. If you select No, a screen is displayed asking you to select the network interface card (NIC) that you want to use for capturing traffic. All network interface cards enabled in the machine appear in a list. 14. Select the desired card and enter the Filtering Service IP and Port numbers. Click Next to continue. NOTE If only one NIC is displayed on the screen, you must select it to continue with the installation. The installer asks if you want to use this instance of Network Agent for HTTP reporting. HTTP Reporting for Network Agent 15. Select Yes or No and click Next to continue the installation. A dialog box is displayed, asking you to select an installation folder for the Network Agent. 50 Embedded on Cisco Content Engine

51 Chapter 4: Installation and Setup 16. You can accept the default path (C:\Program Files\Websense), or click Browse to locate another installation folder, and then click Next to continue. The installer compares the system requirements for the installation you have selected with the resources of the installation machine. If the machine has inadequate disk space or memory, an information screen is displayed detailing the deficiencies. If the installation machine has insufficient disk space, the selected components cannot be installed, and the installer will quit. If the installation machine has less than the recommended amount of memory, the message is advisory only, and you can click Next to continue. To ensure the best performance of the components you are installing, you should upgrade your machine s memory to the recommended minimum. A summary screen is displayed, listing the components that will be installed, the installation path, and the total size of the installation. 17. Click Next to start the installation. An installation progress bar is displayed. When the installer is finished, a message is displayed advising you that the procedure was successful. 18. Click Next to continue. A dialog box is displayed asking you if you want to restart the computer now or wait until later. 19. Select a restart option and click Finish. NOTE You must restart the machine before the installer can be run again. 20. Content EngineContent Enginehe Cisco command line interface: to remove User Service from the Content Engine.dev-ce507 (config)# no websense-server service radius activatetype Exit to exit configuration mode. 21. Write to memory to permanently save the change. Websense Enterprise 51

52 Chapter 4: Installation and Setup CLI Commands on Cisco Content Engine The following installation commands are used on the Cisco Content Engine. Starting all currently installed services: Installed services are started all at once, rather than individually. To start all the currently installed Websense services, use the following CLI command: websense-server enable Installing the Filtering Service: To install the Filtering Service on the Content Engine, use the following CLI command: websense-server service eim activate Starting the Filtering Service: There are several steps you must take before the Filtering Service is ready to begin filtering. 1. Start the Filtering Service with the enable CLI command, which starts all the currently installed components.on the Content Engine: websense-server enable 2. Enter the following command to point the Content Engine to the location of the Filtering Service: url-filter http websense server local port <port number> timeout <seconds> 3. Enter the following command to enable filtering: url-filter http websense enable Uninstalling the Filtering Service: To uninstall the Filtering Service on the Content Engine, use the following CLI command: no websense-server service eim activate Installing the Policy Server: To install the Policy Server, use the following CLI command: websense-server service policy local activate Specifying a remote location for the Policy Server: To specify a remote location for the Policy Server, use the following CLI command: websense-server service policy remote host <IP> port <port> Uninstalling the Policy Server from the Content Engine: To uninstall the Policy Server from the Content Engine, use the following CLI command: no websense-server service policy local activate Uninstalling the Policy Server from a remote machine: To uninstall the Policy Server from a remote machine, use the following CLI command: 52 Embedded on Cisco Content Engine

53 Chapter 4: Installation and Setup no websense-server service policy remote host <IP> port <port> Installing the User Service: To install the User Service on the Content Engine, use the following CLI command: websense-server service user activate Uninstalling the User Service: To uninstall the User Service on the Content Engine, use the following CLI command: no websense-server service user activate Installing the Network Agent: To install the Network Agent on the Content Engine, use the following CLI command: websense-server service network-agent activate Uninstalling the Network Agent: To uninstall the Network Agent on the Content Engine, use the following CLI command: no websense-server service network-agent activate Modifying an Installation If you decide to add, remove, or change the location of a component, run the Websense Installation again. The installer will detect the presence of Websense Enterprise components and offer you the following options for modifying your installation: Adding Components Windows Add Websense Enterprise components Remove Websense Enterprise components Repair an installation if one or more components are not properly installed After installation, you may want to add components to change the configuration of Websense Enterprise in your network. To add components in a Windows environment: 1. Log on to the installation machine with domain and local administrator privileges. Websense Enterprise 53

54 Chapter 4: Installation and Setup If you are installing User Service and DC Agent, this will assure that they have administrator privileges on the domain. IMPORTANT User Service and DC Agent must have administrator privileges on the network to retrieve user login information from the domain controller. Without this information, Websense Enterprise cannot filter by users and groups. If you cannot install these components with such privileges, you may configure administrator privileges for these services after installation by using the Services Properties dialog box. 2. Close all open applications. 3. Run the main Websense Enterprise installation program (Setup.exe). 4. After the welcome screen, a dialog box is displayed asking you what action you want to take with the installed Websense components. 5. Select Add Websense Enterprise Components and click Next. 6. The installer displays a list of components not currently installed on the installation machine. By default, no selections are checked. 7. Check the boxes of those components you want to install and click Next. The installer compares the system requirements for the installation you have selected with the resources of the installation machine. If the machine has inadequate disk space or memory, an information screen is displayed detailing the deficiencies. If the installation machine has insufficient disk space, the selected components cannot be installed, and the installer will quit. If the installation machine has less than the recommended amount of memory, the message is advisory only, and you can click Next to continue. To ensure the best performance of the components you are installing, you should upgrade your machine s memory to the recommended minimum. A summary screen is displayed, listing the components that will be installed, the installation path, and the total size of the installation. 8. Click Next to begin installation. A progress bar is displayed. 54 Embedded on Cisco Content Engine

55 Chapter 4: Installation and Setup If you are installing the Real-Time Analyzer and are using IIS as your Web server, you are prompted for the name of the Web site in the IIS Manager under which the installer should create a virtual directory. The default value is Default Web Site, which is correct in most instances. IMPORTANT If you have renamed the default Web site in the IIS Manager or are using a language version of Windows other than English, you must enter a value in the Web site name field that matches an existing Web site name in the IIS Manager. To enter the correct name of your default Web site (if it is different from Default Web Site), type or paste the desired Web site name into the input field exactly as it appears in the IIS Manager. To open the IIS Manager: a. From the Windows Control Panel, open Administrative Tools. b. Double-click Internet Services Manager. c. The IIS control screen is displayed. d. Expand the tree under your computer name to view available Web site names. e. Right-click on a Web site in which the installer should create the virtual directory and select Properties from the pop-up menu. f. Copy the name of the Web site from the Description field to the clipboard. g. Close the IIS Manager. h. Return to the Virtual Directory screen in the Websense installer and replace Default Web Site with the name from the IIS Manager. i. Click Next to continue the installation. If you are installing the Network Agent, a screen is displayed asking you to select the network interface card (NIC) that you want to use for capturing traffic. All network interface cards enabled in the machine appear in a list. Select the desired card and click Next to continue. Websense Enterprise 55

56 Chapter 4: Installation and Setup If the Network Agent was not installed, a message reminds you that Protocol Management and Bandwidth Optimizer cannot be used unless Network Agent is installed on a machine with direct access to Internet traffic. Click OK to continue. A message is displayed advising you that the installation was successful. When the installation is finished, you are asked whether or not you want to restart the machine. 9. Select a restart option and click Finish. NOTE You must restart the machine before the installer can be run again. Solaris or Linux To add components in a Solaris or Linux environment: 1. Log on to the installation machine as the root user. 2. Determine if your patches are up to date. If Setup advises you that the proper patches are not installed, quit the installer and install the appropriate patch cluster.! WARNING You may continue without the proper patches, but the installation could fail. Continue the installation when you are sure the patches are correct for your system. 3. System requirements The installer compares the system requirements for the installation you have selected with the resources of the installation machine. If the machine has inadequate disk space or memory for optimal performance, separate warnings are displayed. If the installation machine has insufficient disk space, the selected components cannot be installed. If the installation machine has less than the recommended amount of memory, the installation will continue. To ensure the best performance of the components you are installing, you should upgrade your machine s memory to the recommended minimum. 56 Embedded on Cisco Content Engine

57 Chapter 4: Installation and Setup 4. Enter the appropriate CLI command(s) for the component(s) to be added to the Cisco Content Engine integration: Installing the Filtering Service: To install the Filtering Service on the Content Engine, use the following CLI command: websense-server service eim activate Installing the Policy Server: To install the Policy Server, use the following CLI command: websense-server service policy local activate Installing the User Service: To install the User Service on the Content Engine, use the following CLI command: websense-server service user activate Installing the Network Agent: To install the Network Agent on the Content Engine, use the following CLI command: websense-server service network-agent activate Starting all currently installed services: Installed services are started all at once, rather than individually. To start all the currently installed Websense services, use the following CLI command: websense-server enable Starting the Filtering Service: There are several steps you must take before the Filtering Service is ready to begin filtering. a. Start the Filtering Service with the enable CLI command, which starts all the currently installed components.on the Content Engine: websense-server enable b. Enter the following command to point the Content Engine to the location of the Filtering Service: url-filter http websense server local port <port number> timeout <seconds> c. Enter the following command to enable filtering: url-filter http websense enable Websense Enterprise 57

58 Chapter 4: Installation and Setup Removing Components Use the following procedures to uninstall Websense Enterprise components. IMPORTANT The Policy Server Service must be running to uninstall any Websense Enterprise components. Windows Linux To remove installed Websense Enterprise components in a Windows environment: 1. Log on to the installation machine with local administrator privileges. 2. Close all open applications. 3. Run the main installation program (Setup.exe) for Websense Enterprise. After the welcome screen, a dialog box is displayed asking you what action you want to take with the installed Websense Enterprise components. 4. Select Remove Websense Enterprise Components, and then click Next. A list of installed components is displayed. By default, all selections are checked. 5. Clear the check boxes of the components you do not want to remove, and then click Next. A summary list is displayed of the components you have selected to remove. 6. Click Next to begin uninstalling the components. A completion message advises you when the procedure is finished. 7. Click Next to exit the installer. To remove components on an integrated ACNS Content Engine on a Linux machine: 1. Log on as the root user. 58 Embedded on Cisco Content Engine

59 Chapter 4: Installation and Setup 2. Check Policy Server status. If the Policy Server is not running, a dialog box is displayed advising you that removing Websense Enterprise components may require communication with the Policy Server. You may exit the installer to restart the Policy Server or continue uninstalling the selected components.! WARNING Do not uninstall the Policy Server without uninstalling all the Websense components. Removing the Policy Server will sever communication with the remaining Websense components and will require the reinstallation of those components. 3. Uninstall components by using the following CLI commands: Uninstalling the Filtering Service: To uninstall the Filtering Service on the Content Engine, use the following CLI command: no websense-server service eim activate Uninstalling the Policy Server from the Content Engine: To uninstall the Policy Server from the Content Engine, use the following CLI command: no websense-server service policy local activate Uninstalling the Policy Server from a remote machine: To uninstall the Policy Server from a remote machine, use the following CLI command: no websense-server service policy remote host <IP> port <port> Uninstalling the User Service: To uninstall the User Service on the Content Engine, use the following CLI command: no websense-server service user activate Uninstalling the Network Agent: To uninstall the Network Agent on the Content Engine, use the following CLI command: no websense-server service network-agent activate no websense-server service radius activate no websense-server service edir activate Websense Enterprise 59

60 Chapter 4: Installation and Setup The files for the selected components will be removed, but not the information about the components recorded in the config.xml file. This could cause problems if you decide to add these components again at a later date. Summary list A summary list is displayed of the components you have selected to remove. NOTE If you are uninstalling Network Agent on a remote machine after removing the Policy Server, expect the process to take several minutes. Network Agent will be successfully uninstalled, although no progress notification will be displayed. A completion message advises you when the uninstall is complete. 4. Exit when you are finished removing components. Repairing an Installation Windows If a component fails to install properly, or is not performing normally, you can repair the installation. This procedure does not troubleshoot components, but merely overwrites all the installed components using original installation data retrieved from the configuration file. To repair your installation in Windows: 1. Log on to the installation machine with domain and local administrator privileges. 60 Embedded on Cisco Content Engine

61 Chapter 4: Installation and Setup If you are installing User Service and DC Agent, this will assure that they have administrator privileges on the domain. IMPORTANT User Service and DC Agent must have administrator privileges on the network to retrieve user login information from the domain controller. Without this information, Websense Enterprise cannot filter by users and groups. If you cannot install these components with such privileges, you may configure administrator privileges for these services after installation by using the Services Properties dialog box. 2. Close all open applications. 3. Run the main Websense Enterprise installation program (Setup.exe) and follow the onscreen instructions. An option screen informs you that the installer has detected a Websense Enterprise installation and asks you what action you would like to take. 4. Select Repair existing Websense Enterprise components and follow the onscreen instructions. The installer presents a list of Websense services that are running. 5. Click Next to stop the services listed. A progress message is displayed while the installer shuts down Websense services. As soon as the services are stopped an installation progress bar is displayed. When the procedure is finished, a screen is displayed asking you if you want to restart your machine now or later. 6. Select a restart option and click Finish. NOTE You must restart the machine before the installer can be run again. Websense Enterprise 61

62 Chapter 4: Installation and Setup Solaris or Linux To repair components on a Solaris or Linux system: 1. Log on as the root user. 2. Determine if your patches are up to date. If Setup advises you that the proper patches are not installed, quit the installer and install the appropriate patch cluster.! WARNING You may continue without the proper patches, but the installation could fail. Continue the installation when you are sure the patches are correct for your system. The installer detects the currently installed Websense Enterprise components and asks you what action you want to take. 3. System requirements The installer compares the system requirements for the installation you have selected with the resources of the installation machine. If the machine has inadequate disk space or memory for optimal performance, separate warnings are displayed. If the installation machine has insufficient disk space, the selected components cannot be installed. If the installation machine has less than the recommended amount of memory, the installation will continue. To ensure the best performance of the components you are installing, you should upgrade your machine s memory to the recommended minimum. 4. Select Repair Websense Enterprise components and press Enter to advance through the procedure. NOTE There is no repair function for the Websense components installed on the ACNS Content Engine machine. 62 Embedded on Cisco Content Engine

63 Chapter 4: Installation and Setup Initial Setup Repair feature The installer advises you that it will repair the current installation by reinstalling the existing Websense Enterprise components. Websense services A list of currently running Websense services is displayed. The message explains that the installer will stop these services before continuing with the installation. System requirements The installer compares the system requirements for the installation you have selected with the resources of the installation machine. If the machine has inadequate disk space or memory for optimal performance, separate warnings are displayed. If the installation machine has insufficient disk space, the selected components cannot be installed, and the installer will quit. If the installation machine has less than the recommended amount of memory, the installation will continue. To ensure the best performance of the components you are installing, you should upgrade your machine s memory to the recommended minimum. Services restarted The Websense services are restarted after the files are reinstalled. Acrobat Reader If you do not have Acrobat Reader (or the full version of Adobe Acrobat) installed on this machine, a message reminds you that you must have Acrobat Reader to access the documentation. A link to the appropriate Adobe download site is displayed. A completion message advises you when the procedure is finished. 5. Exit when you are finished. You are now ready to perform the final setup tasks for Websense Enterprise. Download the Websense Master Database: You must enter your Websense Enterprise subscription key on the Database Download screen of the Settings dialog box and download the Websense Master Database. See Subscription Key and Database Download, page 64 for instructions. Identify the Content Engine by IP address: If the Content Engine is multihomed (multiple network interface cards), identify the appliance by its IP address in your network so that Websense block messages can be sent to users. See Identifying the Filtering Service for the Block Page URL, page 67. Websense Enterprise 63

64 Chapter 4: Installation and Setup Configure your firewall or Internet router. Upstream network devices such as firewalls and Internet routers must be configured to permit traffic from the Content Engine. See Configuring FireWalls or Routers, page 68 for details. Configure your network to regulate browser access to the Internet in transparent or nontransparent mode. For details, refer to Browser Access to the Internet, page 68. Subscription Key and Database Download The Websense Master Database is the basis for filtering and is updated daily by default. It is downloaded from a remote database server so that your version is the most current. To download the Websense Master Database: 1. Open Websense Manager on any machine where it is installed Select Start > Programs > Websense > Websense Manager. 2. For a first time installation, the Add Server dialog box appears. a. Enter the IP address or the name of the Content Engine on which the Policy Server is installed, and the configuration port established during installation (default is 55806). b. Click OK. The server's IP address or machine name appears in the Manager s navigation pane. 3. Double-click the icon of the Policy Server in the navigation pane. For a first time installation, the Set Websense Password dialog box appears. 4. Set a password (between 4 and 25 characters) for the Policy Server. NOTE Retain this password. It must be entered when you connect to this Policy Server from this or any other Websense Manager, or after the Policy Server is stopped and restarted. 5. Click OK. 6. Select Server > Settings. 64 Embedded on Cisco Content Engine

65 Chapter 4: Installation and Setup The Settings dialog box is displayed. NOTE If no subscription key has been entered, the Settings dialog box appears automatically. Database Download Screen 7. Enter your alphanumeric key in the Subscription key field. NOTE The value in the Subscribed users field shows 0 until the database is successfully downloaded. If your network requires authentication to an upstream firewall or proxy server to reach the Internet and download the Websense Master Database, perform the following procedure: a. Check Use authentication. Websense Enterprise 65

66 Chapter 4: Installation and Setup b. Be sure to configure the upstream proxy server or firewall to accept clear text or basic authentication (for Websense to download the Websense Master Database). c. Enter the User name required by the upstream proxy server or firewall to download the Websense Master Database. d. Enter the Password required by the upstream proxy server or firewall. 8. If your network requires that browsers use an upstream proxy server to reach the Internet, the same proxy settings used by the browser must be used for downloading the Websense Master Database. Establish the proxy settings for the database download as follows: a. Check Use proxy server. b. Enter the IP address of the upstream proxy server or firewall. c. Enter the Port of the upstream proxy server or firewall (default is 80). 9. Click OK. Websense automatically contacts the Websense database server and begins downloading the Websense Master Database. NOTE After downloading the Websense Master Database or updates to the Websense Master Database, and when the Filtering Service is started, CPU usage can be 90% or more while the database is loaded into local memory. 10. Click Done in the Saving Data dialog box. HTTP Reporting and Protocol Management By default, Network Agent is configured for HTTP logging and Protocol Management during installation. If you decide to disable either of these two options, edit the Network Agent settings through the Websense Manager. To disable HTTP logging or Protocol Management: 1. Open Websense Manager on any machine where it is installed. Select Start > Programs > Websense > Websense Manager. 2. Select Server > Settings. The Settings dialog box is displayed. 66 Embedded on Cisco Content Engine

67 Chapter 4: Installation and Setup 3. Select Network Agent from the Settings Selections list. The name of each machine containing an installation of the Network Agent is displayed in the Local Settings structure. 4. Select the instance of Network Agent that you want to modify and click Edit. The local settings for that Network Agent are displayed. 5. Disable either HTTP reporting or Protocol monitoring in the Activities structure by clearing their respective check boxes. 6. Exit the Manager. 7. Stop and restart the Network Agent. Identifying the Filtering Service for the Block Page URL When Websense blocks an Internet request, the browser is redirected by default to a block message page hosted by the Filtering Service. The format of the block page URL typically takes the form: blockpage.cgi If the Cisco Content Engine is multihomed (with two or more network interface cards), you must identify the Content Engine by its IP address in your network so that Websense Enterprise block messages can be sent to users. If the Filtering Service machine name, rather than the IP address, is contained in the block page URL, the users could see a blank page instead of the block message. Use one of the following methods to identify the Filtering Service by IP address: If you have an internal DNS server, associate the machine name of the Filtering Service machine with its correct (typically internal) IP address by entering the IP address as a resource record in your DNS server. See your DNS server documentation for instructions. If you do not have internal DNS, add an entry to the eimserver.ini file with the following procedure. 1. Using FTP, copy the eimserver.ini file from the directory on the Content Engine to a folder on your local drive. 2. Open the eimserver.ini file on your local drive with any text editor. Websense Enterprise 67

68 Chapter 4: Installation and Setup 3. In the [WebsenseServer] area, enter the following command on a blank line: BlockMsgServerName = <IP address> where <IP address> is the correct (typically internal) IP address of the machine running Filtering Service. Do not use the loopback address Save the file. 5. Delete the eimserver.ini file from the Content Engine. For instructions on deleting files from the Content Engine, refer to Initial Setup, page Copy the edited version of the eimserver.ini file into the directory on the Content Engine. 7. Stop and then restart the Filtering Service. See Stopping or Starting Websense Services, page 78 for instructions. Configuring FireWalls or Routers To prevent users from circumventing Websense Filtering Service, your firewall or Internet router should be configured to allow outbound HTTP, HTTPS, FTP, and Gopher requests only from the Cisco Content Engine. Contact your router or firewall vendor for information on configuring access lists on the router or firewall. Browser Access to the Internet IMPORTANT If Internet connectivity of the Websense Manager requires authentication through a proxy server or firewall for HTTP traffic, the proxy server or firewall must be configured to accept clear text or basic authentication to enable the Websense Master Database download. The Cisco Content Engine can regulate Internet activity either transparently or non transparently. In transparent mode, the firewall or Internet router is configured to send Internet requests to the Cisco Content Engine, which queries Websense Enterprise. All configuration changes can be performed through the Content Engine and any connected firewalls or routers with no special configuration required on client workstations. In order to run transparently, you 68 Embedded on Cisco Content Engine

69 Chapter 4: Installation and Setup Language Pack must enable Web Cache Communication Protocol (WCCP) on both the Content Engine and the firewall or router. When regulating Internet activity non-transparently, Web browsers on all client workstations are configured to send Internet requests to the Content Engine. Please see your Cisco Content Engine documentation for instructions. A Websense Enterprise Language Pack is available for translating your English Websense Enterprise system to one of the supported languages: Chinese Simplified French Japanese Spanish Chinese Traditional German Korean English Italian Portuguese (Brazil) The Websense Enterprise Language Pack is run from a remote machine and updates the Policy Server on the Content Engine with foreign language keys. For instructions on applying the Websense Enterprise Language Pack remotely, refer to the documentation accompanying the Websense Enterprise Language Pack. The Websense Enterprise Language Pack can be downloaded as an individual Websense component from: Translated Block Pages You must install the Websense Enterprise Language Pack to use translated block pages. After the Websense Enterprise Language Pack is installed, the translated block pages must be loaded manually into the following folder on the Content Engine: WebsenseEnterprise/EIM/BlockPages/<language code>/default You can localize your Websense Enterprise block messages by copying foreign language versions of the default block pages from the Websense Enterprise Language Pack. To apply translated block pages to your Websense Enterprise installation, you must copy the block pages from the Websense Enterprise Language Pack installation machine to the Content Engine. The Websense Enterprise Language Pack installation can be run from any Windows, Solaris, or Linux machine in your network that can communicate with the Cisco Content Engine. The translated block pages are in a file called Websense Enterprise 69

70 Chapter 4: Installation and Setup BlockPages.zip and are located in the following directory on the Websense Enterprise Language Pack installation machine: /Documentation/Embedded NOTE The procedure for configuring Websense to use translated block pages requires the use of the Cisco CLI (command line interface) which is described in Initial Setup, page 63. To apply translated block pages: 1. Stop the Filtering Service. For instructions on stopping and starting the Filtering Service, refer to Stopping or Starting Websense Services, page Create the following directory structure for the conversion language on the Content Engine: WebsenseEnterprise/EIM/BlockPages/<language code>/default For the language code, select the appropriate value from the following table: Supported Languages Language English French German Italian Japanese Korean Portuguese (Brazilian) Spanish Code en fr de it ja ko pt_br es 70 Embedded on Cisco Content Engine

71 Chapter 4: Installation and Setup Supported Languages Language Chinese Simplified Chinese Traditional Code zh_cn zh_tw For example, the structure for French block pages would be: WebsenseEnterprise/EIM/BlockPages/fr/Default 3. Download the translated block pages into the /<language code>/default folder you have created on the Cisco Content Engine using either the Cisco command line interface or FTP. The following is an example of FTP commands used to upload the BlockPages.zip file: ftp cd local1/websenseenterprise/eim/blockpages/ mkdir ja cd ja mkdir Default cd Default bin mput *.* Answer y for yes to every file transfer question. NOTE You cannot overwrite or delete files on the Content Engine with FTP. If a block page with the same name as the one you want to download already exists in the Default folder, delete the existing file with the Content Engine command line interface before attempting to transfer the translated page. 4. Restart the Filtering Service using the Content Engine command line interface. See the instructions for starting Websense Enterprise on the Content Engine on page 78. Websense Enterprise 71

72 Chapter 4: Installation and Setup The Websense Master Database is reloaded automatically. Creating Custom Block Pages IMPORTANT If you are planning to use Websense Enterprise Reporter to generate reports from this system, be sure to install the appropriate translated version of Reporter. For information about installing Reporter, refer to the Websense Enterprise Reporter Administrator s Guide. You can create custom block pages by modifying the default block pages provided with Websense Enterprise. Websense Enterprise default block message files for an English system are located in the following folder on the Content Engine: WebsenseEnterprise/EIM/BlockPages/en/Default The table below shows block pages by file name and a description of each. IMPORTANT Do not change the contents of files in this folder. File block.html master.html Description Text for the top frame of the block message, indicating that access is restricted. Displays the site requested and the reason why it is restricted. Master frame that appears in the postpone, continue, and quota block messages. This message is replaced by a custom message if you enter an alternate URL in the Block Messages tab of the Server Configuration dialog box in Websense Manager. 72 Embedded on Cisco Content Engine

73 Chapter 4: Installation and Setup File postponeframe.html continueframe.html quotaframe.html moreinfo.html Description Contains text and buttons that appear in the bottom frame when a site is requested which is in a category whose filtering option is set to Defer to AfterWork. Contains text and buttons that appear in the bottom frame when a site is requested which is in a category whose filtering option is set to Defer to AfterWork/Continue. Contains text and buttons that appear in the bottom frame when a site is requested which is in a category whose filtering option is set to Limit by Quota. Contains content for the page that appears when a user clicks the More Information link on the block message. To create custom block pages: 1. Stop the Filtering Service. For instructions on stopping and starting the Filtering Service, refer to page Copy the block page files you want to customize from the WebsenseEnterprise/EIM/BlockPages/<language code>/default folder on the Content Engine to a location on your local drive. Refer to Initial Setup, page 63 for instruction on how to manage files. 3. Open each file in a text editor and make the desired changes. The files contain comments that help guide you in editing the text. Observe the following cautions when editing these files: Do not modify the tokens (enclosed by $* and *$ symbols) or the general structure of the HTML code as it relates to tokens. These portions of the file enable Websense to display specific information in the block message. Do not change the names of customized block page files. Websense looks for block page files by name and will use the ones you have edited in the Websense\EIM\BlockPages\<language code>\custom folder rather than the default pages with the same name located in the Default folder. Websense Enterprise 73

74 Chapter 4: Installation and Setup 4. Save and close the file. 5. Add the customized block page files to the WebsenseEnterprise/WW/ BlockPages/<language code>/custom directory on the Content Engine. You may use either the Cisco CLI or FTP to accomplish this. 6. Restart the Filtering Service to begin using the customized message. Restoring Original Block Pages To restore the original block pages if you experience errors after implementing custom block pages: 1. Stop the Filtering Service. 2. Delete all the files from the WebsenseEnterprise/EIM/BlockPages/ <language code>/custom directory. 3. Restart the Filtering Service. Domain Name System Internet Requests Filtering Internet requests involve DNS in the following situations. URLs must be in the form of IP addresses before Websense Filtering Service can occur. When Websense is integrated with Cisco Content Engine, either the Content Engine or the browser performs a DNS lookup, depending on whether the Content Engine is in transparent proxy mode. IMPORTANT If the Content Engine is set to act as a proxy, it must have access to the domain server to perform the DNS lookup. Once it obtains the IP address, Websense Enterprise searches the Websense Master Database and determines the category to which the site belongs. If more than one site is hosted at the same IP address, or if pages within the site are categorized differently, Websense matches the path that follows the domain name to the list of paths associated with the IP address in the Websense Master Database, and then filters accordingly. 74 Embedded on Cisco Content Engine

75 Block Pages DC Agent Chapter 4: Installation and Setup When Websense Enterprise blocks an Internet request, the browser is redirected by default to a block message page hosted by the Filtering Service. The format of the block page URL will typically take the form: where <EIMServerIPAddress> is the IP address of the Content Engine and <MessagePort> is the message port (default is 15871). In this case, no DNS lookup is needed to resolve a domain name into an IP address because the Content Engine is already named by its IP address. When the Filtering Service is installed on a multi-homed machine (a machine with two or more network interface cards), block page URLs contain a machine name for the Content Engine instead of an IP address because the machine has more than one IP address (an internal and an external address). blockpage.cgi... where <EIMServerMachineName> is the name of the Content Engine and <MessagePort> is the message port (default is 15871). It is always recommended to identify the Filtering Service in your network by an IP address (typically the internal IP address). Refer to Identifying the Filtering Service for the Block Page URL, page 67 for the procedures for identifying the Filtering Service by an IP address. Otherwise, in any case where a machine name is contained in the block page URL, users could see a blank page instead of the block message. DC Agent performs DNS lookup in two cases. At each user login, DC Agent performs DNS lookup to resolve the user s machine name to an IP address. DC Agent records user names together with their corresponding IP addresses. (If the network includes a directory service, user names are first matched against directory service entries.) If you identify the machine where DC Agent is installed by its host name (rather than an IP address) during server configuration, Websense Enterprise performs a DNS lookup to obtain the IP address of DC Agent. This DNS lookup occurs the first time Websense contacts DC Agent, and then according to a pre-defined schedule after that. Websense Enterprise 75

76 Chapter 4: Installation and Setup Configuration File Backups Websense Administrative Status Display All server configuration and policy settings are stored in the config.xml file in the WebsenseEnterprise/EIM/bin directory. Before making changes to the Websense Enterprise configuration or downgrading your Content Engine operating system, you should back up this configuration file to a safe location so that you can restore the established settings in case of any problem. Be sure to date backups of the configuration file. IMPORTANT If the config.xml file becomes very large, it could impact performance in some environments. Refer to Initial Setup, page 63 for instructions on copying and replacing files in the Websense\EIM directory. Content Engine Downgrades Websense Enterprise does not support downgrading. Downgrading the Cisco Content Engine from ACNS version 5.2 to version will downgrade your Websense Enterprise v5.2 to Websense v5.0.1 and will result in the following: You will lose all your v5.2 Websense Enterprise configuration data. The version of Websense Enterprise (v5.0.1) embedded on ACNS v5.1.3 uses a format for the configuration file that is incompatible with the version of Websense loaded on ACNS v5.2. The Websense Enterprise v5.2 Manager and DC Agent will be incompatible with the downgraded Websense installation on the Content Engine. These components must be uninstalled and replaced with the appropriate v5.0.1 components. The v5.0.1 components must then be configured to communicate with the Websense Server. Network Agent is not available in any embedded (or on-box) versions of Websense below v5.2. However, Network Agent can be installed manually on the Content Engine for Websense v5.2. The Protocol Management and Bandwidth Optimizer features require Network Agent and will not be available in the downgraded Websense system. 76 Embedded on Cisco Content Engine

77 Chapter 4: Installation and Setup Real-Time Analyzer is not available with Websense below version v Before Downgrading Copy the v5.0.1 configuration files (config.xml, eimserver.ini, and webserver.ini) found in the WebsenseEnterprise/EIM/OldConfig/5.0.1 folder on the Content Engine to a different network drive. The copy of the config.xml, eimserver.ini, and webserver.ini files in the WebsenseEnterprise/EIM/OldConfig/5.0.1 folder were saved during the Websense Enterprise v5.0.1 upgrade. When you downgrade the Content Engine, the WebsenseEnterprise/EIM/OldConfig/5.0.1 folder will be removed and the copies of the config.xml, eimserver.ini, and webserver.ini files will be deleted. Before you downgrade your Content Engine, copy the config.xml, eimserver.ini, and webserver.ini files from the WebsenseEnterprise\EIM\bin folder to a secure location. NOTE If you upgrade the Content Engine back to v5.2 again, you can copy these files into the upgraded Websense Enterprise v5.0.1 system to restore your pre-downgrade configuration settings. Restoring your Websense v5.0.1 System To restore your Websense v5.0.1 system after an ACNS downgrade: 1. Stop the Websense Server on the Content Engine. See Stopping or Starting Websense Services, page 78 for instructions. 2. Replace the v5.0.1 configuration files (config.xml, eimserver.ini, and webserver.ini) in the Websense Enterprise/EIM/bin folder on the Content Engine with the copy you saved to the safe location before the downgrade. This will restore your pre-upgrade configuration settings in the downgraded Websense v5.0.1 system. Refer to Initial Setup, page 63 for instructions. 3. Restart the Websense Server. 4. Uninstall remote Websense Enterprise v5.2 components by running the Websense Enterprise v5.2 installer on each component machine and following the on-screen instructions. Websense Enterprise 77

78 Chapter 4: Installation and Setup 5. Go to the Websense download site at: 6. Select Evaluation key for use with Websense pre-installed on an appliance to display the list of v5.0.1 components available for download. 7. Download the compressed installation programs for the v5.0.1 Websense Manager and the DC Agent. 8. Unzip the contents of each installation download file to a folder on the network computer where you intend to install the component. 9. Run Setup.exe to install the components. You may install them together on a Windows machine or separately. Refer to your Websense v5.0.1 Cisco Content Engine installation guide for instructions. NOTE If you upgrade your Content Engine to ACNS v5.2 again, you must also upgrade all Websense components on remote machines in your network. Refer to the appropriate installation procedures documented in this guide. Stopping or Starting Websense Services Occasionally you may need to stop or start a Websense service. For example, you must stop the Filtering Service if you want to reset your subscription table at a time other than when it is automatically reset, whenever you edit the eimserver.ini file, and after customizing default block messages. For a list of commands on how to start and stop the Filtering Service and more, see Write to memory to permanently save the change., page 51. NOTE When the Filtering Service is started, CPU usage can be 90% or more for several minutes while the Websense Master Database is loaded into local memory. 78 Embedded on Cisco Content Engine

79 Chapter 4: Installation and Setup Windows Stop, start, or restart a Websense service by using the Services dialog box. Restarting stops the service, then restarts it again immediately from a single command. Windows To stop or start Websense services on a Windows 2000 machine: 2. Select Start > Settings > Control Panel. 3. Double-click Administrative Tools. 4. Double-click Services. 5. Scroll down the list of available services and select a Websense service. Windows 2000 Services List NOTE By default, Websense services are configured to start automatically when the computer is started. Websense Enterprise 79

80 Chapter 4: Installation and Setup 6. From the Action menu, select Start, Stop, or Restart or click one of the control buttons in the toolbar (Stop, Start, or Restart). Restarting stops the service, then restarts it again immediately from a single command. Linux or Solaris Start the service with the following command: websense-server enable Stop the service with the following command: no websense-server enable 80 Embedded on Cisco Content Engine

81 CHAPTER 5 Configuring the Cisco Content Engine Websense works as a filtering engine for Cisco Content Engine, allowing you to enforce your organization's Internet access policies. Once Websense Enterprise has been set up, you must activate it within the Content Engine. This can be done through the Cisco Web-based interface or through a console or TELNET session, by following the instructions in either of the next two sections. NOTE If load bypass or authentication bypass is enabled in the Content Engine, Internet requests that are rerouted will not be filtered by Websense. See your Content Engine documentation for more information. Cisco Web-Based Interface To configure the Content Engine from the Web-based interface: 1. Enable the Content Engine GUI server using the following CLI commands: configure terminal gui-server enable 2. Open a Web browser and connect to the Cisco Content Engine. address>: where:<ip address> is the IP address of the Content Engine machine. The default port is The Enter Network Password dialog box appears. 3. Enter a valid administrator user name and password that allows access to the initial management page. 4. Select Caching > URL Filtering. The URL Filtering page is displayed. Websense Enterprise 81

82 Chapter 5: Configuring the Cisco Content Engine Enabling the Content Engine GUI Server 82 Embedded on Cisco Content Engine

83 Chapter 5: Configuring the Cisco Content Engine 5. Select the Websense Filtering option. 6. Enter the following information: Field Websense Server Port Timeout Description The machine name or IP address of the machine running Websense Server. The port on which Websense will communicate with the Content Engine. The default is The amount of time (between 1 and 120 seconds) that the Content Engine should wait for a response from Websense before permitting a site. The default is 20 seconds. 7. Select URL Filtering > System > Websense Server. The Websense Server is displayed. Websense Enterprise 83

84 Chapter 5: Configuring the Cisco Content Engine Websense Server When Accessed Through GUI 84 Embedded on Cisco Content Engine

85 Chapter 5: Configuring the Cisco Content Engine Console or TELNET Session To configure the Content Engine with a console or TELNET session: 1. Access the Cisco Content Engine, either from a console connection or a TELNET session from a remote terminal. 2. Enter the global configuration mode with the configure command. You must be in global configuration mode to enter global configuration commands. Console# configure terminal Console(config)# 3. To enable Websense URL filtering with Websense on the Content Engine, use the url-filter global configuration command. url-filter http websense server local -or- If you are not using the default port or the filtering is on another machine, add the port and filtering IP information to the configuration command. For example: url-filter http websense server <filtering ip> port <port#> timeout <seconds> Variable port # Description Port on which the Content Engine will communicate with the Websense Server. seconds Amount of time in seconds (between 1 and 120) that the Content Engine will wait for a response from Websense Server before permitting a site. Content Engine only permits sites after the timeout if it has been configured to do so. See step 4 for more information. NOTE The Port and Time settings have defaults and probably should not change. Websense Enterprise 85

86 Chapter 5: Configuring the Cisco Content Engine 4. Optionally, you can use the url-filter http websense allowmode enable command to configure the Content Engine to permit requests after a Websense Server timeout. Otherwise, it will block requests. 5. To enable URL filtering, enter: url-filter http websense enable To disable URL filtering, enter: no url-filter http websense enable 6. Type the exit command to exit the global configuration mode. 7. Save the configuration changes to memory with the write memory command. This prevents your changes from disappearing if the Content Engine is restarted. Once the Websense Master Database has been downloaded, and Websense has been activated within Cisco Content Engine, Websense is ready to filter Internet requests. Refer to the Websense Enterprise Administrator s Guide for information about configuring Websense for filtering. File Management on the Content Engine Management of Websense files on the Content Engine is performed with the Cisco command line interface (CLI) or file transfer protocol (FTP). This includes copying, deleting, or adding files to the WebsenseEnterprise directory. Command Line Interface (CLI) The Cisco command line interface (CLI) is the primary file editing tool. You can use the CLI to copy, delete, or add files to the WebsenseEnterprise directory. You must have administrator rights to use the CLI to manage files. The following command deletes files from the Content Engine: delfile <file-name> The following command transfers files from an FTP server to the Content Engine: copy ftp disk <remote-ftp-server> <remote directory path> <remote file name> <local file name> 86 Embedded on Cisco Content Engine

87 Chapter 5: Configuring the Cisco Content Engine For a complete list of Cisco commands, refer to the following Web site: acns50/cref50/14623c50.pdf File Transfer Protocol (FTP) FTP can be used to copy files from or add new files to the WebsenseEnterprise directory. You cannot delete or overwrite files using FTP. To use FTP to copy or add files, you must log on to the Content Engine as an administrator. CLI Command Displaying Websense Administrative Status Use the following Cisco exec commands to display the Filtering Service status and administrative information: show websense-server This command displays the following Filtering Service information: Status (running or stopped) Version number Port numbers Installed components Websense Enterprise 87

88 Chapter 5: Configuring the Cisco Content Engine 88 Embedded on Cisco Content Engine

89 APPENDIX A Configuring Windows NTLM for User Authentication Proxy authentication through use of a Windows NT Lan Manager (NTLM) proxy server is used to validate client (user) credentials to minimize database queries and improve the performance on the Content Engine and authentication database. The Microsoft Internet Explorer browser can be set to automatically store the user s credentials for a default time period of 480 minutes (eight hours) or a timeout period to suit your needs, so that subsequent requests can be validated against the domain controller. Configuring the Browser for Promptless Authentication Promptless NTLM can be used by customers requiring a single logon or by those looking to transparently log the domain\username in the transaction logs. The NTLM protocol is proprietary and, therefore, only accepted by Microsoft Internet Explorer browsers. If the Content Engine challenges a Netscape browser with NTLM, the Netscape browser will ask for a username and password. By default the Microsoft Internet Explorer browser is not configured to automatically respond to a user s credentials without prompting for a username and password. To enable promptless authentication, the browser must be configured to automatically log on with current username and password. To configure the Microsoft Internet Explorer browser for promptless authentication to automatically log on with current username and password: 1. For Windows 2003, go to your Start menu and select Settings > Control Panel > Internet Options. The Internet Options dialog box displays. 2. Select the Security tab. The following options display in Internet Explorer version 6. Websense Enterprise 89

90 : 3. Click Custom Level to change the User Authentication logon security setting. Scroll to the end of the Options to find and change the security settings for User Authentication. 90 Embedded on Cisco Content Engine

91 : 4. Select Automatic logon with current username and password to set the automatic logon for promptless user authentication. Configuring the Content Engine The Content Engine needs to be configured with the primary (and secondary if appropriate) domain controller s host name or IP address and the name of the domain. NOTE The Content Engine cannot be configured with more than one domain. If your network has many domains, the configured domain must trust all other domains with valid user accounts. Domains should not include overlapping users and groups, because the Content Engine authenticates the user regardless of the username and password. Enter the domain controller s name or IP address and the name of the domain. For example: ntlm server host primary Websense Enterprise 91