Websense Web Security and Websense Web Filter Use this organizer to prepare to install and configure Websense Web Security or Websense Web Filter, Version 7. This guide helps you gather the hardware, network, and deployment information that you need to install the product. This document includes 3 sections: Web filtering checklist Network card (NIC) configuration Reporting checklist For specific deployment instructions for networks of all sizes and traffic loads, see the Deployment Guide, available from: www.websense.com/supportportal/. Download the Websense software installer from www.websense.com. You can install Websense software components together or separately using the same installation program. Web filtering checklist 1. Software prerequisites Depending on your deployment, some or all of the following software is required to install and run Websense software: Integration product: Any supported firewall, proxy server, or network appliance that you want to integrate with Websense software must be installed and running before Websense software installation. Check the Deployment Guide for supported versions. The Stand-Alone Edition does not require an integration product. Integration Version Directory service: If you are using a directory service, such as Windows Active Directory or Novell edirectory, to identify users, the directory service must be installed and configured. Adobe Acrobat or Acrobat Reader: You must have Adobe Acrobat or Acrobat Reader software installed to view the Deployment Guide, the Installation Guide, and the supplements for each. NetBIOS: Logon Agent uses a logon script to identify users transparently. If you plan to use Logon Agent, client workstations must have NetBIOS for TCP/IP enabled and the TCP/IP NetBIOS Helper Service running (Windows XP, Windows Server 2003, Windows 2000, and Windows NT only). Any machine on which Websense Filtering Service is installed must have Internet access: Internet access: To download the Websense Master Database (required for filtering to occur), each Filtering Service machine must be able to access the following URLs: download.websense.com ddsdom.websense.com ddsint.websense.com my.websense.com Websense Web Security and Websense Web Filter Page 1 v7-2008-11-12
2. Network considerations See the Deployment Guide for more information about Websense software components. Filtering Service machines must be able to communicate with the integration product (if any) and Websense Network Agent (if installed). Network Agent monitors all Internet traffic for the Stand-Alone Edition, and can be used to monitor non-http protocol traffic in an integrated deployment. It also captures data about bandwidth usage. Multiple Filtering Service instances may be needed in distributed networks. If Network Agent is used, it must be deployed where it can see all internal Internet traffic for the network segment that it is assigned to monitor. Multiple installations of Network Agent may be needed in distributed networks. User Service must be able to communicate with the directory service to enable user- and group-based filtering. User Service is generally installed on the same machine as Policy Server. 3. System requirements See the Deployment Guide for detailed hardware, software, and operating system recommendations. Operating systems Windows Windows Server 2003 (Standard or Enterprise), with or without Service Pack 1, or R2 Linux Red Hat Enterprise Linux v5: base server Red Hat Enterprise Linux v4: AS, ES, or WS Red Hat Enterprise Linux v3: AS, ES, or WS Hardware These recommendations apply to networks of about 1000 users. Websense filtering and reporting components are installed on separate machines. See the Deployment Guide for recommendations for larger deployments. Filtering components (Windows or Linux) Filtering components include Filtering Service, Policy Broker, Policy Server, User Service, Network Agent, and a transparent identification agent (DC Agent [Windows only], Logon Agent, edirectory Agent or RADIUS Agent). Quad-Core Intel Xeon processor, 2.5 GHz or greater 2 GB of RAM 10 GB of free disk space Note that these components can be installed on separate machines, depending on your network configuration and the volume of Internet requests. Windows reporting components The Windows reporting components include Websense Manager, Log Server, and Log Database* (running on Microsoft SQL Server 2005/2000 or MSDE). Quad-Core Intel Xeon processor, 2.5 GHz or greater 4GB RAM 100 GB of free disk space Websense Web Security and Websense Web Filter Page 2 v7-2008-11-12
Linux reporting components The Linux reporting components include Websense Explorer for Linux, Log Server, and Log Database* (running on MySQL 5.0). Quad-Core Intel Xeon processor, 2.5 GHz or greater 2 GB of RAM 80 GB of free disk space * The Log Database can be created in an existing, supported database engine, running on a separate machine. 4. Installation information Identify the machines in your network that will host Websense components. The account used to install Websense software must have domain and local administrator privileges. Filtering Service can be installed on the same machine as Policy Server and Policy Broker. Some deployments may require multiple Policy Servers. Filtering Service machine Policy Broker/Policy Server machine Machine name Machine name IP address User name User name Password Password Port (default 15686) Port (default: 55806) Additional Policy Server (if applicable) Machine name User name Password Port (default: 55806) Network cards (NICs) When you install Websense software on a machine with multiple NICs, you are prompted to select a NIC to use for communication between components. Network Agent (if installed) also uses this NIC to send block messages. You can select the same NIC for each task. NIC #1 Communication NIC Monitoring NIC Description NIC #2 Communication NIC Monitoring NIC Description Websense Web Security and Websense Web Filter Page 3 v7-2008-11-12
Additional Network Agent instances If your network configuration requires multiple Network Agent instances, make sure that each Network Agent machine can see all Internet traffic on the network segment it is configured to monitor. See the Deployment Guide for network configuration details. See the Websense Manager Help for Network Agent configuration instructions. Monitored network segment: IP address range: to Network Agent machine name Monitored network segment: IP address range: to Network Agent machine name Monitored network segment: IP address range: to Network Agent machine name Other networks or machines to monitor Additional Filtering Service instances If your network configuration requires multiple Filtering Service instances, make sure that every Filtering Service machine can communicate with the Policy Server machine. Filtering Service #1 Filtering Service #2 Filtering Service #3 Subscription key You must enter a valid subscription key or evaluation key in Websense Manager to download the Websense Master Database and begin filtering. Subscription key Websense Web Security and Websense Web Filter Page 4 v7-2008-11-12
Transparent identification agent If you want to apply user- and group-based policies, but do not want users to be prompted for logon information when they access the Internet, you can either configure your integration product to pass user information to Websense software, or install a Websense transparent identification agent. See the Deployment Guide for details. edirectory Agent: identifies Novell edirectory users. DC Agent identifies users Windows Active Directory or Windows NT Directory users. Logon Agent works with a logon script to identify users logging on to a Windows domain. You must deploy a logon script to all Windows client machines. DC Agent and Logon Agent can work together to increase user identification accuracy. DC Agent must use an account with domain administrator privileges to retrieve user information. User name Password edirectory Agent must have administrative privileges on the Novell edirectory Server. Distinguished name Password The Logon Agent logon script requires the Logon Agent IP address and port number. Port number (default is 15880) 5. Installation location Accept the default location: C:\Program Files\Websense (Windows) /opt/websense (Linux) Choose another location 6. Initial setup After installing Websense software, some basic configuration steps are required to being monitoring and filtering Internet activity. Launch Websense Manager and log on using the WebsenseAdministrator password created during installation. You can then enter your subscription key to download the Master Database. You may also need to configure proxy settings to allow Filtering Service to connect to the Internet, and configure Network Agent to monitor the appropriate network segment. The New User Quick Start tutorial provides quick and easy steps to complete basic Websense software configuration. Consult the Websense Manager Help for complete and detailed configuration instructions. The tutorial and Help are accessed via Websense Manager. WebsenseAdministrator password WebsenseAdministrator is the default account used to access Websense Manager. This account has full administrative privileges, and cannot be deleted. The WebsenseAdministrator password that you create during installation must be between 4 and 25 characters. A strong password (including a combination of upper- and lowercase letters, numbers, and special characters) is recommended. Websense password Websense Web Security and Websense Web Filter Page 5 v7-2008-11-12
Proxy servers Master Database download The following information is needed if Filtering Service connects through an upstream proxy server to download the Master Database. Machine name Port number (default is 8080) If the proxy server requires authentication, indicate which account Filtering Service should use: User name Password Network Agent You will need to configure Network Agent to recognize any proxy/cache servers used by monitored machines. The Network Agent IP address is the address of the NIC used for communication with other Websense components. Network Agent Proxy server Network Agent Proxy server Network Agent Proxy server s Identify which network segment each Network Agent instance monitors When Network Agent is installed, you can define which network segments and individual machines are monitored. By default, Network Agent is configured to monitor the entire network. See Additional Network Agent instances, page 4. Identify which ports the integration product scans for HTTP traffic (if Network Agent is present) If Websense software is integrated with a firewall, proxy server, or network appliance, and Network Agent is also installed, configure Network Agent to ignore the ports that the integration product scans for HTTP traffic. (Network Agent can send log data about traffic on these ports to Filtering Service for some integrations.) Ports the integration product scans for HTTP traffic (default is 80, 8080) Network card (NIC) configuration If you install Network Agent on a machine with multiple network cards (NICs), the NIC used to monitor Internet requests can be set to stealth mode. In stealth mode, the NIC has no IP address, and cannot be used for communication. This prevents outside connections to the NIC, and stops unwanted broadcasts, strengthening security and improving network performance. Perform this configuration and note how each NIC in the machine is configured before installing Websense software. NIC configuration is performed using the Windows Network Connections dialog box: 1. Go to Start > Settings > Network and Dial-up Connection. A list of available NICs is displayed. 2. Select the network card that you want to configure, and then select File > Properties. A dialog box displays connection properties for the selected NIC. 3. Clear the Internet Protocol (TCP/IP) checkbox. 4. Click OK. Websense Web Security and Websense Web Filter Page 6 v7-2008-11-12
Reporting checklist The following checklist is designed to help you prepare to install Websense reporting components. For detailed installation instructions, refer to the Installation Guide (Windows) or the Websense Explorer for Linux Administrator s Guide (Linux). 7. Determine how you want to deploy reporting components Websense reporting components generally run on a dedicated machine. Websense Manager is used to access reporting components in Windows environments. Websense Explorer is used in Linux environments. Log Server and the Log Database (which requires a supported database engine) can reside on the same machine. You can also create the Log Database using a database engine on a separate machine. Log Server: Receives and stores Internet activity data for reporting. Note Log Server and the Log Database are required for reporting. Log Database: Provides storage Internet activity data. Database Engine: Microsoft SQL Server 2005/2000 or MSDE (Windows), or MySQL 5.0 (Linux) If you are using Microsoft SQL Server 2005 or 2000, you must perform the installation steps in a specific sequence to avoid installation problems. See the Installation Guide. The supported version of Microsoft SQL Database Engine (MSDE) is available from the Websense Web site. See the Websense Knowledge Base details. Database machine, if separate: See the Deployment Guide for deployment recommendations. 8. Keep in mind The following Websense components must be running when reporting components are installed. Policy Broker Policy Database Policy Server Filtering Service User Service If you changed the port numbers used by Websense filtering components during installation, write down the new ports. You may need the information when you install reporting components. New ports Strict browser pop-up blocking settings may restrict or prevent the use of some reporting features. Adjust the browser settings as needed. If you are installing a non-english version of Websense software on Windows 2003, apply Microsoft Windows 2003 Service Pack 1 (SP 1) before downloading the Websense Language Pack. Websense Web Security and Websense Web Filter Page 7 v7-2008-11-12
If you install Log Server on the Microsoft SQL Server machine, and later upgrade SQL Server, the changes may prevent Log Server from starting. If this happens, uninstall and reinstall Log Server. 9. Installing reporting components The same installer program is used to install both filtering and reporting components. Important For performance reasons, Websense, Inc., does not recommend installing Websense filtering components and reporting components on the same machine. 10. Verify that you have the appropriate software and hardware Websense components can be distributed across multiple machines. Reporting components rely on the filtering components. Install Websense filtering components first. Ensure that the machines that you plan to use meet the hardware, operating system, database engine, and other guidelines provided in the Deployment Guide. 11. Verify and record the Policy Server location Verify and record the IP address or host name of the Policy Server machine. Provide the port number used for Policy Server communication (by default, 55806). You can select a different port if the default is not available 12. Database engine location and connection information Record the IP address (preferred) or name of the database engine machine (Microsoft SQL Server 2000/ 2005 or MSDE). When the database engine is located on a remote machine, the default Log Database location is C:\Program Files\Microsoft SQL Server\Mssql\Data. If Microsoft SQL Server or MSDE was installed with an instance name, this directory is incorrect. In this case, specify an existing directory for the Log Database. Is a Trusted Connection used to connect to the database? Note Websense, Inc., recommends against using a Trusted Connection to connect to an MSDE database. Enter the user name and password that will be used to access the database. User name For MSDE, use the sa account. Password The account used to access the database must be a member of the public and SQLAgentUserRole roles in the Microsoft SQL Server 2005 msdb database. See the Websense Manager Help for details. Websense Web Security and Websense Web Filter Page 8 v7-2008-11-12
13. Determine where to install the database Log Server and the database engine on the same machine: Click Browse to select a directory on the local machine to use for the Log Database. Log Server and the database engine on different machines: Enter a location for the Log Database. The directory must already exist, and reside on a drive local to the database engine machine. Important Create a directory to house the Log Database before installing reporting components. If Log Server and the database engine are on different machines, and you enter a location that does not exist, a problem can occur. Make sure there is enough free disk space on the selected drive to create and maintain the Log Database. Depending on the number of filtered users, your network setup, and your database configuration, the Log Database may grow rapidly. See the Websense Deployment Guide for sizing information. 14. Configure log record size Log Server can create a single record for each Web site requested (visit), or create a separate record for each file (image, advertisement, embedded page, etc.) displayed as the result of a URL request (hits). By default, Visits are logged to decrease the size of the database and speed report generation. Change this option if you prefer to record Hits. You can also choose to consolidate log records to minimize the size of the database. This option combines multiple visits by the same user to the same Internet domain in a single record. See the Installation Guide or Websense Manager Help for more information. 15. Installation location Accept the default location: C:\Program Files\Websense (Windows) /opt/websense (Linux) Choose another location Websense Web Security and Websense Web Filter Page 9 v7-2008-11-12