websense V10000 User manual

Getting Started
v1.2
Websense®V10000 Appliance

©1996–2009, Websense, Inc.
10240 Sorrento Valley Rd., San Diego, CA 92121, USA
All rights reserved.
Published 2009 Revision C
Printed in the United States of America and Ireland
The products and/or methods of use described in this document are covered by U.S. Patent Numbers 5,983,270; 6,606,659; 6,947,985; 7,185,015;
7,194,464 and RE40,187 and other patents pending.
This document may not, in whole or in part, be copied, photocopied, reproduced, translated, or reduced to any electronic medium or machine-
readable form without prior consent in writing from Websense, Inc.
Every effort has been made to ensure the accuracy of this manual. However, Websense, Inc., makes no warranties with respect to this
documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Websense, Inc., shall not be liable for
any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein.
The information in this documentation is subject to change without notice.
Trademarks
Websense is a registered trademark of Websense, Inc., in the United States and certain international markets. Websense has numerous other
unregistered trademarks in the United States and internationally. All other trademarks are the property of their respective owners.
Microsoft, Windows, Windows NT, Windows Server, Windows Vista and Active Directory are either registered trademarks or trademarks of
Microsoft Corporation in the United States and/or other countries.
Novell, Novell Directory Services, eDirectory, and ZENworks are trademarks or registered trademarks of Novell, Inc., in the United States and
other countries.
Pentium and Xeon are registered trademarks of Intel Corporation.
This product includes software developed by the Apache Software Foundation (www.apache.org).
Copyright (c) 2000 The Apache Software Foundation. All rights reserved.
Other product names mentioned in this manual may be trademarks or registered trademarks of their respective companies and are the sole property
of their respective manufacturers.
WinPcap
Copyright (c) 1999 - 2009 NetGroup, Politecnico di Torino (Italy).
Copyright (c) 2009 CACE Technologies, Davis (California).
All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
• Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
• Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
• Neither the name of the Politecnico di Torino, CACE Technologies nor the names of its contributors may be used to endorse or promote products
derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Getting Started  3
Contents
Topic 1 Introducing the Websense V10000 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Websense V10000 environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Windows Server 2003 or 2008 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Operating System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Additional Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Database Engine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Directory Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Other . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Deployment scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Single appliance deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Multiple appliance deployment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Implementing clustering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Topic 2 Setting up the Websense V10000. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Set up the appliance hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Clustering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Perform initial command line configuration . . . . . . . . . . . . . . . . . . . . . 14
Configure the V10000 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Install Websense Manager and Log Server . . . . . . . . . . . . . . . . . . . . . . 18
Add or install optional components . . . . . . . . . . . . . . . . . . . . . . . . . 22
Configure Websense Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Special directory service considerations . . . . . . . . . . . . . . . . . . . . . . 25
Configure Websense Content Gateway . . . . . . . . . . . . . . . . . . . . . . . . . 27
Test and refine your policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Recovering the V10000 appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Logon Portal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Online Help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Technical Support. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

4  Websense V10000
Contents

1
Getting Started 5
Introducing the Websense
V10000
The Websense V10000 appliance is a high-performance platform for Websense Web
Security Gateway, combining Websense Web Security filtering and Websense Content
Gateway proxy cache on a single, high-powered machine. The V10000 solution also
uses a separate Windows 2003 or 2008 Server in the network, which houses Websense
Manager (the configuration interface for Websense Web Security) and Log Server
(which processes filtering log records into a separate Microsoft SQL Server database).
This security solution offers:
V10000 Console, a Web-based configuration interface that offers appliance
management features like:
System dashboard, with up-to-the-minute status of the software modules and
system resources
Appliance configuration and network settings
System administration, including patch management and backup and restore
Events related to appliance configuration and patching are logged. The log entries
can be viewed in the V10000 Console, or the entire log file can be downloaded for
viewing.
Command line interface for basic appliance settings, available through a USB
keyboard and monitor or a serial port connection, that provides basic appliance
control commands
Basic proxy caching and Web filtering after minimal initial configuration
Full customization of proxy caching and Web filtering available through these
separate Web-based configuration interfaces:
Websense Content Manager — proxy caching
Websense Manager — Web filtering
Websense V10000 environment
The V10000 solution uses additional hardware and software in your network. Some
elements are required, such as the Windows 2003 (or 2008) server. Others are
optional, such as a directory service, which allows you to apply Web filtering policy to
individual users and groups in your organization.

Introducing the Websense V10000
6 Websense V10000
Windows Server 2003 or 2008
In addition to the V10000 appliance, you must have a separate server machine that
meets the requirements listed below. This is the machine where you install Websense
Manager (the configuration interface for Web filtering) and Log Server (the
component that receives Internet activity information and processes it into the Log
Database.)
Hardware
Quad-Core Intel Xeon processor, 2.5 GHz or higher
4-16 GB RAM
100 GB free disk space utilizing a disk array
High speed disk access
Operating System
Windows Server 2008 (Standard, Enterprise, and Datacenter) installed in 32-bit
native mode
Windows Server 2003, R2 (Standard or Enterprise)
Windows Server 2003, SP1 or SP2 (Standard or Enterprise)
Windows Server 2003 (Standard or Enterprise)
Additional Software
Internet Explorer 7 or Firefox 2 or 3
Common Desktop Environment (CDE)
Apache Tomcat 6.0.13 (installed automatically with Websense Manager)
Adobe Flash Player 8 or later
Database Engine
One of the following supported database engines is required to store log data for
reporting. Although this software can run on the same Windows server machine that
runs Websense Manager and Log Server, better performance is achieved when it runs
on a dedicated server.
Important
Self-signed certificates are created to secure
communications between Websense components. In order
for these certificates to be valid, and for communication to
succeed, all the machines running Websense components
must have the same date.
Please set the appliance time and the time on the Windows
server machine before installing Websense Manager and
Log Server.

Getting Started 7
Introducing the Websense V10000
One of these databases:
Microsoft SQL Server 2005 SP2 or SP 3 (Workgroup, Standard, Enterprise, or
64-bit edition) (recommended)
Microsoft SQL Server 2000 SP4
MSDE 2000 SP4 - suitable for smaller networks
The following recommendations apply to the machine running the database engine,
especially if it runs on the same Windows server as Websense Manager and Log
Server.
You can improve I/O performance by installing the Log Database on a disk array
running RAID level 1+0.
The amount of required RAM depends on the total number of requests being
stored and the number of requests per second being processed. To optimize RAM
usage, use the Enterprise Edition of Microsoft SQL Server on a machine running
Windows Server 2003 Enterprise Edition or Windows Server 2008 Enterprise
Edition or Datacenter.
Directory Service
If your network includes one of the supported directory services listed below, you can
apply Web filtering to individual users, groups, and domains (OUs). Additionally, you
can install an optional transparent identification agent to ensure clients in a supported
directory service are filtered without being prompted to log on when they open a
browser. (If no directory service is installed, Websense Web Security uses IP
addresses for Web filtering.)
For organizations where multiple administrators may access Websense Content
Manager or Websense Manager, the Web-based configuration interfaces for Websense
Content Gateway and Websense Web Security, administrators with accounts in most
supported directory services can log on with their network credentials.
Windows Active Directory
Windows NT Directory
Novell eDirectory 8.51 or later
NMAS authentication is supported.
Recommend Novell Client v4.83 or v4.9 (v4.81 and later are supported)
Other LDAP-based directory services
Note
If your network uses a Windows NTLM directory service,
or Active Directory in mixed mode, you must create
Websense accounts for any administrators who must log
on to Websense Manager (see Websense Manager Help for
instructions). This configuration does not support logging
on to Websense Manager with network credentials.

Introducing the Websense V10000
8 Websense V10000
Most standard RADIUS servers
The following RADIUS servers have been tested:
Livingston (Lucent) 2.x
Cistron RADIUS server
Merit AAA
Microsoft IAS
Other
In some networks, additional machines may be used to deploy additional instances of
Network Agent or other, optional components. For example, in a large, segmented
network, you may need a separate Network Agent for each segment, and a separate
Filtering Service for these Network Agents. Or, you might deploy the Remote
Filtering Server to enable filtering of laptops and other computers that are outside the
organization’s network.
For information about system requirements and appropriate placement of machines
for additional or optional components, see the Websense Deployment Guide.
Deployment scenarios
One or more Websense V10000 appliances can be deployed in a network, depending
on the traffic volume and security goals. Review the diagrams and information for
these deployment scenarios before implementing the V10000 in your network.
All deployments should be well planned. Please contact your Websense Sales
Engineer, or your authorized Websense reseller, for assistance in planning your
deployment.
BImportant
If you change the policy source (machine running Policy
Broker and Policy Server) after deploying components on
additional machines, you must reconfigure those
components to communicate with the new policy source.
Go to the Websense Knowledge Base, and search for the
article titled v7: Changing the Policy Server (or Policy
Broker) IP address.

Getting Started 9
Introducing the Websense V10000
Single appliance deployment
When you deploy a single Websense V10000 appliance to host all major features, one
additional Windows server is required to run Websense Manager and Log Server.
Typically, they are deployed in the network as shown below.
In all environments, the cable for network interface N must be connected to a span
port, monitor port, or mirror port on the router or switch. This enables it to see traffic
from all clients being filtered.
Network interfaces C and P1 must both be able to access a DNS server and the
Internet.
If network interface C is used to send protocol blocking information, as it is by
default, C must be able to communicate with client machines.
Network interface P2 can be connected the same way as P1, if you need 2
interfaces. The P2 interface is optional.
If you plan to implement explicit proxy, ensure that clients can reach the VLAN
where interface P1 is connected.
If you plan to implement transparent proxy for Websense Content Gateway,
WCCP should be enabled on the switch, as shown in the diagram.
See the Websense Content Gateway Administrator’s Guide for additional information
about deploying transparent or explicit proxy.

Introducing the Websense V10000
10 Websense V10000
Multiple appliance deployment
Organizations that need to filter more users or a larger volume of Internet traffic may
deploy multiple Websense V10000 appliances. One appliance is designated as
primary, and the others point to the primary appliance for policy and configuration
settings.
The cable for network interface N must be connected to a span port, monitor port, or
mirror port on the router or switch. This enables it to see traffic from all clients being
filtered.
Network interfaces C and P1 must both be able to access a DNS server and the
Internet.
If network interface C is used to send protocol blocking information, as it is by
default, C must be able to communicate with client machines.
Network interface P2 can be connected the same way as P1, if you need 2
interfaces. Interface P2 is optional.
If you plan to implement explicit proxy, ensure that clients can reach the VLAN
where interface P1 is connected.
If you plan to implement transparent proxy for Websense Content Gateway,
WCCP should be enabled on the router.
See the Websense Content Gateway Administrator’s Guide for additional information
about deploying transparent or explicit proxy.
When you deploy multiple V10000 appliances, one appliance is designated as primary
(that is, the policy source). It becomes the centralized source for policy and
configuration information for the other appliances.
To implement a multiple appliance deployment, configure the primary V10000 to use
itself as the policy source. Then, configure all other V10000 appliances to use the

Getting Started 11
Introducing the Websense V10000
primary appliance as their policy source by entering the IP address assigned to
network interface C on the primary appliance. See Configure the V10000, page 15, for
more information.
Implementing clustering
To implement clustering with V10000 appliances, choose a dedicated clustering
interface, and then add a route rule to specify that communications between Websense
Content Gateway and the Clustering Multicast Group Address will go through the
dedicated clustering interface. This process is described in detail in the Websense
Knowledge Base in an article titled: V10000 Clustering.
BImportant
If you change the policy source (machine running Policy
Broker and Policy Server) after deploying components on
additional machines, you must reconfigure those
components to communicate with the new policy source.
Go to the Websense Knowledge Base, and search for the
article titled v7: Changing the Policy Server (or Policy
Broker) IP address.

Introducing the Websense V10000
12 Websense V10000

2
Getting Started 13
Setting up the Websense
V10000
Setting up the Websense V10000 involves the following tasks, which are detailed in
this chapter.
1. Set up the appliance hardware, page 13
2. Perform initial command line configuration, page 14.
3. Configure the V10000, page 15.
4. Install Websense Manager and Log Server, page 18.
5. Configure Websense Manager, page 23.
6. Configure Websense Content Gateway, page 27.
7. Test and refine your policies, page 28.
When setup is complete, you can use the Logon Portal to log on to any of the three
related management consoles.
Set up the appliance hardware
The Quick Start guide, which comes in the shipping box with your appliance, provides
information on the contents of the Websense V10000 shipping box; explains how to
set up the hardware; and shows how to connect the cables to the appliance and to your
network.
Network interface C and the proxy interface (typically P1) must be able to access a
DNS server and must have continuous access to the Internet. Essential databases are
downloaded from Websense servers through these interfaces. Ensure that C and P1 are
able to access the download servers at download.websense.com.
Make sure that this address is permitted by all firewalls, proxy servers, routers, or host
files that control the URLs that the C and P1 interfaces can access.
Clustering
Refer to the Websense Knowledge Base on the Websense Support Portal,
www.websense.com/kb for instructions on setting up the V10000 appliance as part of
a proxy cluster. Search for the exact phrase: V10000 clustering.

Setting up the Websense V10000
14 Websense V10000
After hardware setup, connect directly to the appliance through the serial port or the
monitor and keyboard ports. The activation script, called firstboot, runs when you start
the appliance.
Perform initial command line configuration
The first time you start the appliance, a brief script (firstboot) prompts you to supply
settings for the network interface labeled C and a few other general items.
Gather the following information before running the script. Some of this information
may have been gathered on the Quick Start during hardware setup.
When you have gathered the necessary information, run the initial command line
configuration, as follows.
1. Access the appliance through the a USB keyboard and monitor or a serial port
connection.
2. Accept the subscription agreement when prompted.
3. When asked if you want to begin, enter yto launch the firstboot activation script.
NOTE: To rerun the script manually, enter the following command:
firstboot
4. Follow the onscreen instructions to provide the information collected above.
Hostname
IP address for network interface C
Subnet mask for network interface C
Default gateway for network interface C
(IP address)
Primary DNS server for network interface C
(IP address)
Secondary DNS server for network interface C
(IP address) Optional
Tertiary DNS server for network interface C
(IP address) Optional
Unified password to be used for the three consoles:
V10000 Console, Websense Manager, and Content
Manager.
(8 to 15 characters, at least 1 letter and 1 number)
Note
To configure the appliance, you must connect through the
serial port or the keyboard/video ports and complete the
firstboot script.

Getting Started 15
Setting up the Websense V10000
5. After the activation script has been completed successfully, go to a different
machine and use a supported Web browser to access the V10000 Console.
Configure the V10000
The V10000 Console is the Web-based configuration interface for the appliance.
Through it you can view system status, configure network and communication
settings, and perform general V10000 administration tasks.
After completing the initial configuration required by the firstboot script, use the
V10000 Console to configure important settings for network interfaces N and P1 (and
optionally P2), which are used for communications by Network Agent and Websense
Content Gateway.
Gather the following information before running the V10000 Console. Some of this
information may have been gathered on the Quick Start during hardware setup.
Primary NTP server, (domain) Optional
Secondary NTP server, (domain) Optional
Tertiary NTP server, (domain) Optional
IP address for network interface P1
Subnet mask for network interface P1
IP address for network interface P2
Required only if P2 is enabled
Subnet mask for network interface P2
Required only if P2 is enabled
Default gateway for network interfaces P1 (and
P2); (IP address)
Primary DNS server for network interfaces P1 (and
P2); (IP address)
Secondary DNS server for network interfaces P1
(and P2); (IP address) Optional
Tertiary DNS server for network interfaces P1 (and
P2); (IP address) Optional
Is network interface N connected to a bidirectional
span port?
YES or NO
IP address for network interface N
Required only if network interface N is connected to
a bidirectional span port
Subnet mask for network interface N
Required only if network interface N is connected to
a bidirectional span port

Setting up the Websense V10000
16 Websense V10000
After collecting the information needed, access the V10000 Console through a
supported browser.
The following procedure summarizes the settings that must be configured to enable
default proxy caching and filtering. See the V10000 Console Help for detailed
instructions on any field or area, or for information about other available settings.
1. Open a supported browser, and enter the following URL in the address bar:
https://<IP address>:9447/appmng
Replace <IP address> with the address assigned to network interface C during
initial configuration of the V10000. (See Perform initial command line
configuration, page 14.)
2. Log on with the user name admin and the password set during initial appliance
configuration.
3. In the left navigation pane, click Configuration > General.
a. Set the time zone.
b. Select Internet Network Time Protocol (NTP) servers for time
synchronization, or specify the system time and date. (Use of an NTP server is
recommended, to ensure that database downloads and time-based policies are
handled precisely.)
c. Click Save in the Time and Date area.
4. In the left navigation pane, click Configuration > Network Interfaces.
Default gateway for network interface N
(IP address)
Required only if network interface N is connected to
a bidirectional span port
Primary DNS server for network interface N
(IP address)
Required only if network interface N is connected to
a bidirectional span port
Secondary DNS server for network interface N,
(IP address)
Optional: Used only if network interface N is
connected to a bidirectional span port
Tertiary DNS server for network interface N, (IP
address)
Optional: Used only if network interface N is
connected to a bidirectional span port

Getting Started 17
Setting up the Websense V10000
a. Configure network interfaces P1 (and optionally P2) for Websense Content
Gateway. Then, click Save in the Websense Content Gateway Interface area.
These network interfaces can accept users’ Internet requests (inbound traffic)
and communicate with Web servers (outbound traffic).
One common configuration is to use P1 for traffic into and out of the proxy
module. Another common configuration uses P1 for inbound traffic and P2
for outbound traffic. To enable this configuration, be sure to set appropriate
routing rules for P1 and P2 on the Configuration > Routing page. For
example, you might set outbound traffic to go through P2.
Additionally, you can use P2 as a communication channel for multiple proxy
servers in a cluster. In this scenario, P2 cannot be used for outbound traffic.
For additional information on clusters, see the Websense Content Gateway
Administrator’s Guide.
b. Configure network interface N for Network Agent. Then, click Save in the
Network Agent Interface area.
Network interface N monitors all Internet requests, and enforces policy for
protocols other than HTTP and HTTPS.
5. In the left navigation pane, click Configuration > Routing.
a. Use the Add Route button to specify customized, static routes.
b. Use the Edit and Delete buttons to modify existing routes, as needed.
6. In the left navigation pane, click Configuration > Policy Source.
a. Specify the location of Websense Web Security policy information.
• Choose This V10000 appliance if the policy for your deployment is
located on the V10000 being configured.
Important
When you use the P2 interface, the P1 interface is bound to
eth0, and the P2 interface is bound to eth1. Keep this in
mind when you configure Websense Content Gateway.
For example, suppose you are using transparent proxy, and
the P1 interface is connected to the WCCP router. In this
case, you must configure Websense Content Gateway to
use eth0 for WCCP communications (in Content Manager,
see Configure > Networking > WCCP, WCCP version
tab).
Note
The V10000 appliance does not send block messages to
users who are blocked from non-HTTP and non-HTTPS
protocols.

Setting up the Websense V10000
18 Websense V10000
• Choose Another V10000 appliance or server on your network if the
V10000 currently being configured is not the location of the policy
information. Then, enter the IP address of the server that is used as the
policy source. (If the policy source is another V10000 appliance that is
configured as primary, enter the IP address of its network interface C.)
b. Click Save.
7. Click Log Off, at the top right, to log off the Websense V10000 Console.
8. Configure Websense Content Gateway for default operation. See Configure
Websense Content Gateway, page 27.
Install Websense Manager and Log Server
Deploying the Websense V10000 appliance also requires installing a database engine;
Websense Manager; and Log Server on a separate Windows server machine in the
network. A supported database engine must also be installed, either on the same
Windows server machine or a different machine in the network.
Websense Manager is the interface for Websense Web Security configuration and
policy management.
Log Server receives records of Internet filtering activity and sends them to the Log
Database, which is installed on a database engine.
If you do not have a supported database engine, you can download and install MSDE
for free. Refer to the Websense Knowledge Base on the Websense Support Portal,
www.websense.com/kb for a download link and further instructions. Search for the
exact phrase: Installing MSDE with Websense software, version 7.
See the Websense Installation Guide for more details on configuring the database
engine, including prerequisites such as setting up user roles, and the database rights
needed for the account specified during Log Server installation.
Before installing the policy and reporting components, be sure your server machine
meets the hardware and software requirements. See Websense V10000 environment,
page 5.
Important
The database engine must be installed and running before
you install Log Server.

Getting Started 19
Setting up the Websense V10000
Gather the following information before running the installer. Some of this
information may have been gathered on the Quick Start during hardware setup
The following procedure summarizes the steps required to install the required
components. See the Websense Installation Guide for more detailed instructions.
1. Log on to the installation machine with administrative privileges.
If you will use a Windows trusted connection to communicate with the database
engine, your logon user account must also be a trusted account with local
administration privileges on the database machine.
2. Make sure the date and time are synchronized with the date and time on the
V10000 appliance.
3. Download the installation package from www.mywebsense.com.
4. Close all applications and stop any anti-virus software.
5. Double-click the installation package to extract the files and start the installation.
6. Follow the onscreen instructions to the Subscription Agreement screen.
7. Select Ye s , and click Next.
8. Select a Custom installation, and click Next.
Policy Server IP address
(IP address of the policy source machine.
Typically, this is the IP address for
network interface C on the appliance)
Database engine location
(IP address or machine name)
Database user name
Database password
Important
Self-signed certificates are created to secure
communications between Websense components. In order
for these certificates to be valid, and for communication to
succeed, all the machines running Websense components
must have the same date.
Please set the appliance time and the time on the Windows
server machine before installing Websense Manager and
Log Server.

Setting up the Websense V10000
20 Websense V10000
9. In the list of components, mark the check boxes for Log Server and Websense
Manager and any other optional components to be installed on this machine.
See the Websense Deployment Guide and Installation Guide for descriptions of
the available components, and associated installation requirements.
10. Clear all other check boxes, and then click Next.
11. When asked for the IP address of the Policy Server machine, enter the IP address
of the policy source machine (typically, this is the IP address for network interface
C on the V10000 appliance).
12. Accept the default port number (55806), and click Next.
13. For the Database Engine Location, enter the name or IP address of the machine
on which a supported database engine is running.
14. Select a database access method, and then click Next.
SQL database account—Enter the user name and password for a SQL
Server account that has administrative access to the database. This is the
recommended method.
BImportant
If you change the policy source (machine running Policy
Broker and Policy Server) after deploying components on
additional machines, you must reconfigure those
components to communicate with the new policy source.
Go to the Websense Knowledge Base, and search for the
article titled v7: Changing the Policy Server (or Policy
Broker) IP address.
BImportant
Be sure to clear the check boxes for these components:
Policy Broker
Policy Server
Filtering Service
User Service
Usage Monitor
Remote Filtering Server
Remote Filtering Client
Note
The SQL Server password cannot begin or end with a
hyphen (-).