V-Series Release Notes v7.6.1

V-Series Release Notes v7.6.1

Topic 80031 / Updated: 12-August-2011

Applies To:

Websense V-Series Appliances v7.6.1 Models: V5000 G2 and V10000 G2

Contents

Overview

Deployment and installation

New in version v7.6.1

Operation tips

Known issues

Overview

These Release Notes pertain to

new users of the Websense V-Series appliance at version 7.6.1

existing Websense users who wish to migrate from an older version to the appliance at version 7.6.1

Included in the notes are descriptions of two new deployment options, installation tips, and known issues.

Version 7.6.1 of the Websense V-Series appliance is not a bug-fix release.

There is no patch for this release.

Appliance version 7.6.1 is available as an ISO image on the Downloads page of the Websense Web site.

The release introduces two new deployment options for the appliance, as described in these notes. The firstboot script has been updated, to enable you to choose the new options, if desired. The Appliance Manager has also been updated, to enable you to configure the new deployment options.

Web Security Gateway and Email Security Gateway modules running on the appliance are unchanged from v7.6.0 modules running on the v7.6.0 appliance. Therefore:

Appliances at v7.6.1 are fully compatible with Websense v7.6.0 appliances. They can coexist in a network and communicate well with each other.

Appliances at v7.6.1 are also fully compatible with Websense v7.6.0 software modules running off the appliance, such as the TRITON Unified Security Center, Data Security components, Filtering Service, Network Agent, Policy Server, Log Server, and so forth.

No off-appliance software is included in this release. Download and use the v7.6.0 or 7.6.0.1 installers for all off-box components.

New with this version of the appliance are two deployment options:

Websense Web Security v7.6.0 [V5000 G2 only.] Operates in stand-alone mode or integrated with Microsoft ISA/TMG; Cicso ASA/PIX; or Citrix Presentation Server.

Websense Web Security v7.6.0 + Email Security Gateway / Anywhere v7.6.0 [both V5000 G2 and V10000 G2] Web Security on this appliance operates in stand-alone mode or integrated with Microsoft ISA/TMG; Cicso ASA/PIX; or Citrix Presentation Server.

Each V-Series model now has four deployment options:

V-Series model	Security mode with options shown
V5000 G2	Web mode Web Security v7.6.0 or Web Security Gateway / Anywhere v7.6.0 Email mode Email Security Gateway / Anywhere v7.6.0 Web and Email mode Web Security v7.6.0 + Email Security Gateway / Anywhere v7.6.0
V10000 G2	Web mode Web Security Gateway / Anywhere v7.6.0 Email mode Email Security Gateway / Anywhere v7.6.0 Web and Email mode Web Security v7.6.0 + Email Security Gateway / Anywhere v7.6.0 or Web Security Gateway / Anywhere v7.6.0 + Email Security Gateway / Anywhere v7.6.0

A single V5000 G2 Recovery Image supports all deployment options available for that model. A single V10000 G2 Recovery Image supports all options available for the V10000 G2 model.

For detailed information about each Websense component, see the v7.6.0 Release Notes:

TRITON Unified Security Center

Websense Web Security

Websense Data Security

Websense Email Security Gateway

Websense Content Gateway

Deployment and installation

Websense V-Series appliance version 7.6.1 is available to both new customers and customers migrating from earlier software or appliance releases.

If you deploy multiple V-Series appliances, v7.6.0 and v7.6.1 can be used together in the same network, for sites running Web Security Gateway / Anywhere. Do not intermix v7.6.1 appliances in a network with Websense software or appliance versions prior to v7.6.0.

Web Security (no gateway) was not available on the appliance at v7.6.0.

New customers

Until a later version is released, new appliances are shipped with v7.6.1 pre-installed. Download and use the TRITON manager installer for v7.6.0.1 to set up essential Windows components and optional components, as needed. See the Getting Started Guide for details.

Existing customers

Existing customers can optionally choose to migrate to v7.6.1.

The v7.6.0 appliance configuration can be migrated to 7.6.1 appliances through the Full Appliance Configuration Backup/Restore.

Alternatively, you can migrate data from any 7.6.0 module that is also installed on a 7.6.1 appliance using the Web or Email module backup file from 7.6.0.

If you are currently running Web Security v7.5.4 on a V5000 G2, see this Knowledge Base article for migration steps.

The full appliance migration process is available to V-Series appliance customers currently on version 7.6.0.

 

Note  V-Series appliance users on version 7.5 who wish to migrate to version 7.6.1 must first upgrade the appliance to version 7.6.0. For upgrade instructions to v7.6.0, see Upgrading V-Series Appliances to v7.6.

 

Note  Users of appliance v7.5.4 can restore only the policy configuration to v7.6.1. For further information, refer to the Knowledge Base article.

Migration steps

The following migration instructions apply only to migrations from v7.6.0. If your version is older, you must first migrate to v7.6.0.

1.	Download the v7.6.1 ISO image from the Downloads page at MyWebsense.

Existing customers with a MyWebsense account can download the software package as an ISO image directly from the Websense Web site.

2.	Perform a full appliance backup on v7.6.0 and save the backup files to the local drive.

For instructions on how to perform a backup and restore on an appliance, refer to the document Backup and Restore FAQ: How do I back up and restore V-Series appliances.

3.	Burn the ISO image to a DVD to create a recovery DVD disc.

4.	Perform a fresh install of appliance v7.6.1. (Begin with the primary appliance if you have multiple Websense appliances.)

a.	Insert the recovery DVD into the appliance. If installation does not start automatically, select Start > Run and then choose setup.exe.

b.	Follow the prompts to complete the installation.

c.	When the installation is complete, run the firstboot script.

5.	Multiple deployment only: Reconnect secondary appliances to the primary appliance:

a.	Log on to the appliance manager for each box.

b.	Set the policy source relationship using the same settings that you used for v7.6.0.

6.	Restore the backup files to v7.6.1 to complete the migration.

a.	Multiple deployment only: All backup files should be restored one-by-one in the same sequence as the backup. For off-box components, be sure to restart all services after restoring the appliances.

For instructions on how to restore an appliance from a backup file, refer to the Websense Appliance Manager Help: Restoring a backup file.

 

For more information about upgrading the V-Series appliance, visit the Upgrade Center on the Websense Web site.

New in version v7.6.1

Support for new deployment options

New with this version of the appliance are two deployment options:

Websense Web Security v7.6.0 [V5000 G2 only.] Operates in stand-alone mode or integrated with Microsoft ISA/TMG; Cicso ASA/PIX; or Citrix Presentation Server.

Websense Web Security v7.6.0 + Email Security Gateway / Anywhere v7.6.0 [both V5000 G2 and V10000 G2] Web Security on this appliance operates in stand-alone mode or integrated with Microsoft ISA/TMG; Cicso ASA/PIX; or Citrix Presentation Server.

The firstboot script has been updated, to enable you to choose one of the new options, if desired. Select the security mode when you run the firstboot script. The security mode cannot be changed simply by running firstboot again. Instead, you must reinstall the Recovery Image and then re-run firstboot.

The Appliance Manager has also been updated, to enable you to configure the new deployment options.

Operation tips

Setup tip

When configuring V-Series appliances that use interfaces P1 and P2, set P1 (eth0) and P2 (eth1) in different subnets. Assigning a different subnet for different network interfaces enables Web and email traffic for each interface to be managed separately.

Avoiding port conflicts

See the ports list for a table of the default Websense ports.

Check the ports list to avoid port conflicts if you plan to make a change from a default port.

For example, if you want to use an HTTP proxy server port that is different from the default port (8080), be sure to check the ports list first, to avoid conflict with ports already in use by the V-Series.

Logging tip

If you want to examine log files for Network Agent in Appliance Manager, be sure to turn on Network Agent logging in the TRITON™ - Web Security console first. To do this, log on to TRITON - Web Security and navigate to the Settings > Network Agent > Global page. Then scroll down to Additional Settings to enable logging of protocol traffic and specify a logging interval.

Deployment tips

When Policy Broker is run on a V-Series appliance (configured as the Full policy source), all Policy Servers that point to that Policy Broker (configured as User directory and filtering) must be installed on V-Series appliances as well. You cannot install and run Policy Servers on off-box machines and point them to a Policy Broker that runs on an appliance. This configuration is not supported.

However, you can run Policy Server on multiple appliances (User directory and filtering mode) and point these appliances to a Policy Broker running either on or off an appliance.

Interface bonding enables your site to share the load under one common identity, with multiple adapters load-balancing under a single IP address. This is also known as link aggregation or trunking.

If you have implemented interface bonding, but do not see load balancing working as expected, the problem may be resolved by configuring your switch to disable flowcontrol send. For information on how to disable flowcontrol send, refer to the hardware manufacturer's help files.

 

Note  The flowcontrol issue affects customers who use the load-balance mode. Customers who use the hot-standby mode, or other interface bonding mode, will not encounter this issue.

Subscription key tip

This tip applies only to sites running Web Security Gateway Anywhere. In a deployment with multiple Policy Server appliances, use the Websense Web Security Gateway Anywhere subscription key for the policy source appliance (the Policy Server that connects to Sync Service), and use a Web Security Gateway subscription key for all other appliances. Otherwise, you receive superfluous hybrid filtering alerts.

Importing routes

Routes can be imported via a plain text file. How invalid entries are handled depends on the type of invalid data.

If a route specifies an invalid port (one that does not exist on the appliance), an error displays and no routes are added.

If a route specifies an invalid IP address, that route is not added, while properly formed entries are added.

Known issues

A list of known issues for V-Series appliance v7.6.1 is available to customers with a current MyWebsense account.

Other known issues are linked to the Release Notes for v7.6.0:

TRITON Unified Security Center

Websense Web Security

Websense Data Security

Websense Email Security Gateway

Websense Content Gateway

 

If you are not currently logged in to MyWebsense, the links above take you to a login prompt. Log in to view the list.

 

V-Series Release Notes v7.6.1