Forcepoint Web Security On-prem v8.5.

x | Installation Guide

Step 10: Install Content Gateway

If you are not using appliances to host policy enforcement components, complete these steps to install Content
Gateway on one or more Linux servers.

Note
Make sure the server hosting the Content Gateway has external connectivity allowed and can reach
the domains listed below.
■ [Link]
■ [Link]
■ [Link]
■ [Link]
A constant access to these domains is recommended as various product services, including (but not
limited to) URL database, AV definitions, and licensing need the open connection with Forcepoint for
the purpose of maintenance, update or validation.
DNS queries can narrow down the relevant servers for your location. Prolonged period of more than
two weeks without connectivity may result in license invalidation and policy enforcement will no
longer occur.

Prepare for installation

Steps
1) Make sure that the server you intend to use meets or exceeds the requirements listed in the “Content
Gateway” section of “Requirements for web protection solutions” in System requirements for this version.
See Installing on Red Hat Enterprise for additional details on installing on Red Hat Linux.

29
Forcepoint Web Security On-prem v8.5.x | Installation Guide

2) Configure a hostname for the Content Gateway machine and also configure DNS name resolution. Complete
these steps on the machine on which you will install Content Gateway.
a) Configure a hostname for the machine that is 15 characters or less:
hostname <hostname>

b) Update the HOSTNAME entry in the /etc/sysconfig/network file to include the new hostname
assigned in the previous step:
HOSTNAME=<hostname>

c) Specify the IP address to associate with the hostname in the /etc/hosts file. This should be static and
not served by DHCP.
The proxy uses this IP address in features such as transparent authentication and hierarchical caching.
This must be the first line in the file.
Do not delete the second and third lines (the ones that begin with “[Link]” and “::1”, respectively).
Also, do not add the hostname to the second or third line.

[Link] <FQDN> <hostname>

[Link] [Link] localhost

::1 localhost6.localdomain6 localhost6

<FQDN> is the fully-qualified domain name of this machine (for example: [Link]).
<hostname> is the same name specified in Step a.
Do not reverse the order of the FQDN and hostname.

d) Configure DNS in the /etc/[Link] file.

search <subdomain1>.<top-level domain> <subdomain2>.<top-level domain>
<subdomain3>.<top- level domain>

nameserver [Link]
nameserver [Link]
This example demonstrates that more than one domain can be listed on the search line. Listing several
domains may have an impact on performance, because each domain is searched until a match is found.
Also, this example shows a primary and secondary nameserver being specified.

e) Gather this information:

■ Default gateway (or other routing information)
■ List of your company’s DNS servers and their IP addresses
■ DNS domains to search, such as internal domain names. Include any legacy domain names that your
company might have.
■ List of additional firewall ports to open beyond SSH (22) and the proxy ports (8080-8090).

30
Forcepoint Web Security On-prem v8.5.x | Installation Guide

3) For Content Gateway to operate as a caching proxy, it must have access to at least one raw disk. Otherwise,
Content Gateway will function as a proxy only.
To create a raw disk for the proxy cache when all disks have a mounted file system:

Note
This procedure is necessary only if you want to use a disk already mounted to a file system as a
cache disk for Content Gateway. Perform this procedure before installing Content Gateway.

Warning
Do not use an LVM (Logical Volume Manager) volume as a cache disk.

Warning
The Content Gateway installer will irretrievably clear the contents of cache disks.

a) Enter the following command to examine which file systems are mounted on the disk you want to use for
the proxy cache:
df -k

b) Open the file /etc/fstab and comment out or delete the file system entries for the disk.

c) Save and close the file.

d) Enter the following command for each file system you want to unmount:
umount <file_system>
When the Content Gateway installer prompts you for a cache disk, select the raw disk you created.

Note
It is possible to add cache disks after Content Gateway is installed. For instructions, see
the Content Gateway Manager Help.

4) If you plan to deploy multiple, clustered instances of Content Gateway:

■ Find the name of the network interface you want to use for cluster communication. This must be a
dedicated interface.
■ Find or define a multicast group IP address.
If a multicast group IP address has not already been defined, enter the following at a command line to
define the multicast route:
route add <[Link] address>/32 dev <interface_name>
Here, <interface_name> is the name of the interface used for cluster communication. For example:
route add [Link]/32 dev eth1

5) It is recommended that the Content Gateway host machine have Internet connectivity before starting the
installation procedure. The software will install without Internet connectivity, but analytic database updates
cannot be performed until Internet connectivity is available.

31
Forcepoint Web Security On-prem v8.5.x | Installation Guide

6) Download the ContentGateway85xSetup_Lnx.[Link] installer tar archive to a temporary directory on the

machine that will host Content Gateway.
To download the Content Gateway installer:
a) Log on to the Forcepoint Downloads page.

b) Select Web Security from the Product.

c) Select Content Gateway from the Product Options.

d) Click WCG v8.5.x Content Gateway Software from the Installer list.

Note
Only latest version is available under Installer list. If you want to select the previous
versions, then use Click here from Content Gateway.

e) Click Download in the Product Installer page to download the Content Gateway installer
ContentGateway85xSetup_Lnx.[Link].

To unpack the tar archive, use the command:

tar -xvzf ContentGateway85xSetup_Lnx.[Link]

7) Consider the following security issues prior to installing Content Gateway:

■ Physical access to the system can be a security risk. Unauthorized users could gain access to the file
system, and under more extreme circumstances, examine traffic passing through Content Gateway. It
is strongly recommended that the Content Gateway server be locked in an IT closet and that a BIOS
password be enabled.
■ Ensure that root permissions are restricted to a select few persons. This important restriction helps
preclude unauthorized access to the Content Gateway file system.
■ For a list of default ports, see the Web tab of the Forcepoint Ports spreadsheet. They must be open to
support the full set of Forcepoint Web Security features.

Note
If you customized any ports that your web protection software uses for communication,
replace the default port with the custom port you implemented.

Restrict inbound traffic to as few other ports as possible on the Content Gateway server. In addition, if
your subscription does not include certain features, you can restrict inbound traffic to the unneeded ports.
For example, if your subscription does not include the Forcepoint Web Security DLP Module, you may
choose to restrict inbound traffic to those ports related to Forcepoint DLP.
■ If your server is running the Linux IPTables firewall, you must configure the rules in a way that enables
Content Gateway to operate effectively. See IPTables for Content Gateway.

8) Content Gateway can be used as an explicit or transparent proxy. For setup considerations for each option,
see the Content Gateway explicit and transparent proxy deployments.

32
Forcepoint Web Security On-prem v8.5.x | Installation Guide

Installer gives NetworkManager or avahi-

daemon error
When Red Hat Enterprise Linux is installed with a graphical user interface (GUI), the Content Gateway installer
recognizes systems running NetworkManager or avahi- daemon processes and emits an error similar to the
following:

Error: The avahi-daemon service is enabled on this system and must be disabled before Content
Gateway v8.5.x can be installed.
Please disable the avahi-daemon service with the following commands and restart the Content Gateway
installation.
chkconfig --levels 2345 avahi-daemon off
service avahi-daemon stop

Warning
Content Gateway is supported on Red Hat Enterprise Linux, Basic Server (no GUI) and is not
supported on RHEL with a GUI.

To continue, the conflicting NetworkManager and avahi-daemon processes must be stopped.

1) To disable the avahi-daemon service, enter the following commands:

chkconfig --levels 2345 avahi-daemon off service avahi-daemon stop

2) Restart the installer:

./wcg_install.sh

Install Content Gateway

Steps
1) Disable any currently running firewall on this machine for the duration of Content Gateway installation.
Bring the firewall back up after installation is complete, opening ports used by Content Gateway.

Important
If SELinux is enabled, set it to permissive or disable it before installing Content Gateway. Do
not install or run Content Gateway with SELinux enabled.

Important
Forcepoint Web Security customers using Red Hat Enterprise Linux or CentOS 7.x must
disable firewalld prior to installing Content Gateway.
On the machine where Content Gateway will be installed, execute the following:
systemctl stop firewalld
systemctl disable firewalld

36
Forcepoint Web Security On-prem v8.5.x | Installation Guide

2) Make sure you have root permissions:

su root

3) In the directory where you unpacked the tar archive, begin the installation, and respond to the prompts to
configure the application.
./wcg_install.sh
The installer installs Content Gateway in /opt/WCG . It is installed as root.

Note
Up to the configuration summary, you can quit the installer by pressing Ctrl-C. If you choose
to continue the installation past the configuration summary and you want to quit, do not use
Ctrl-C. Instead, allow the installation to complete and then uninstall it.
If you want to change your answer to any of the installer prompts, you will be given a chance
to start over at the first prompt once you reach the configuration summary; you do not have to
quit the installer.

4) If your server does not meet the minimum hardware requirements or is missing required operating system
packages, you will receive error or warning messages.
Install the missing packages, reboot the server, and again start the Content Gateway installer.
Here is an example of a system resource warning:

Warning: Content Gateway requires at least 6 gigabytes of RAM.

Do you wish to continue [y/n]?

Enter n to end the installation and return to the system prompt.

Enter y to continue the installation. If you choose to run Content Gateway after receiving this warning,
performance may be affected.

5) Read the subscription agreement. At the prompt, enter y to continue installation or n to cancel installation.
Do you accept the above agreement [y/n]? y

37
Forcepoint Web Security On-prem v8.5.x | Installation Guide

6) Enter and confirm a password for the Content Gateway Manager administrator account.
Note that the cursor will not move while you are entering your password.

Enter the administrator password for the Content Gateway management interface.
Username: admin
Password:>
Confirm password:>

This account enables you to log on to the management interface for Content Gateway (the Content
Gateway manager). The default username is admin.
To create a strong password (required), use 8 to 15 characters, with at least 1 each of the following: upper
case letter, lower case letter, number, special character.

Important
The password cannot contain the following characters:
■ space
■ $ (dollar symbol)
■ : (colon)
■ ‘ (backtick; typically shares a key with tilde, ~)
■ \ (backslash)
■ “ (double-quote)

7) Enter an email address where Content Gateway can send alarm messages:

Content Gateway requires an email address for alarm notification.

Enter an email address using @ notation: [] >

Be sure to use @ notation (for example, user@[Link]). Do not enter more than 64 characters for
this address.

8) Select 1 as your Content Gateway Integration Configuration:

'1' - Select '1' to configure Content Gateway as a component of Forcepoint Web Security
'2' - Select '2' to configure Content Gateway as a component of Forcepoint DLP (without
Forcepoint Web Security)

9) Enter the IP address for Policy Server:

Enter the Policy Server IP address (leave blank if integrating with Data Security only): [] >
Use dot notation (i.e., [Link]). The address must be IPv4.

10) Enter the IP address for Filtering Service:

Enter the Filtering Service IP address: [<Policy Server address>] >
The default is the same address as Policy Server.

38
Forcepoint Web Security On-prem v8.5.x | Installation Guide

11) Review default Content Gateway ports:

Content Gateway uses 9 ports on your server:

PortAssignments:
'1' Content Gateway Proxy Port 8080
'2' Web Interface port 8081
'3' Auto config port 8083
'4' Process manager port 8084
'5' Logging server port 8085
'6' Clustering port 8086
'7' Reliable service port 8087
'8' Multicast port 8088
'9' Endpoint Authentication ServerPort 9090

Enter the port assignment you wouldlike to change:

'1-9' - specific port changes
'X' - no change
'H' - help
[X] >

Change a port assignment if it will conflict with another application or process on the machine. Otherwise,
leave the default assignments in place.
If you do not want to use these ports for Content Gateway, or if the installation program indicates that a
port conflict exists, make any necessary changes. Any new port numbers you assign must be between
1025 and 65535, inclusive.

12) For clustering, at least two network interfaces are required. If your machine has only one, the following
prompt appears:
Content Gateway requires at least 2 interfaces to support clustering. Only one active network
interface is detected on this system.
Press Enter to continue installation and skip to Step 13.

13) If two or more network interfaces are found on this machine, you are asked whether this instance of
Content Gateway should be part of a cluster:

Content Gateway Clustering Information

'1' - Select '1' to configure Content Gateway for management clustering. The nodes in the
cluster will share configuration/management information automatically.
'2' - Select '2' to operate this Content Gateway as a single node.

Enter the cluster type for this Content Gateway installation:

[2] >

If you do not want this instance of Content Gateway to be part of a cluster, enter 2.
If you select 1, provide information about the cluster:

Enter the name of this Content Gateway cluster.

><cluster_name>

Note: All members of a cluster must use the same cluster name and multicast group address.

Enter a network interface for cluster communication.

Available interfaces:
<interface, e.g., eth0>
<interface, e.g., eth1>
Enter the cluster network interface:
>
Enter a multicast group address for cluster <cluster_name>.
Address must be between [Link] - [Link]:
[<default_IP_multicast_address>] >

39
Forcepoint Web Security On-prem v8.5.x | Installation Guide

14) For Content Gateway to act as a web cache, a raw disk must be present on this machine. If no raw disk is
detected, the following prompt appears:

No disks are detected for cache.

Content Gateway will operate in PROXY_ONLY mode.

Content Gateway will operate as a proxy only and will not cache web pages. Press Enter to continue the
installation and skip Step 15.

40
Forcepoint Web Security On-prem v8.5.x | Installation Guide

15) If a raw disk is detected, you can enable the web cache feature of Content Gateway:

Note
If you choose to not enable raw disk cache now, cache disks may be added after Content
Gateway has been installed. For instructions, see the Content Gateway Manager Help.

Would you like to enable raw disk cache [y/n]? y

a) Select available disks from the list. Selected disks become dedicated cache disks and cannot be used
for any other purpose. Cache disks must be raw. Aggregate disk cache size should not exceed 147
GB.

Select available disk resources to use for the cache. Remember that space used for the
cache cannot be used for any other purpose.
Here are the available drives
(1) /dev/sdb 146778685440 0x0

Note: The above drive is only an example.

Warning
Although it might be listed as available, do not use an LVM (Logical Volume Manager)
volume as a cache disk.

b) Indicate if you want to add or remove disks individually or as a group.

Choose one of the following options:

'A' - Add disk(s) to cache
'R' - Remove disk(s) from cache
'S' - Add all available disks to cache 'U' - Remove all disks from cache
'X' - Done with selection, continue Content Gateway installation.
Option: > A
[ ] (1) /dev/sdb 146778685440 0x0

c) Specify which disk or disks to use for the cache.

Enter number to add item, press 'F' when finished:

[F] >1
Item '1' is selected
[F] >

d) Your selections are confirmed. Note the “x” before the name of the disk.

Here is the current selection

[X] (1) /dev/sdb 146778685440 0x0

e) Continue based on your choice in Step b, pressing X when you have finished configuring cache disks.

Choose one of the following options:

'A' - Add disk(s) to cache
'R' - Remove disk(s) from cache
'S' - Add all available disks to cache 'U' - Remove all disks from cache
'X' - Done with selection, continue Content Gateway installation.
Option: >X

41
Forcepoint Web Security On-prem v8.5.x | Installation Guide

16) As a way of improving the Content Gateway product, you can elect to send Forcepoint information about
usage statistics, analyzed content, and activated product features. Important: Individual users are never
identified.
Enter y or n.

17) A configuration summary appears, showing your answers to the installer prompts (note: summary below is
an example):

Configuration Summary
Content Gateway Install Directory : /opt/WCG
Admin Username for Content Gateway Manager: admin
Alarm Email Address : <email_address>
Content Gateway Install Type : Web Security
Policy Server IP Address : <IP_address>
Filtering Service IP Address : <IP_address>
Content Gateway Cluster Type : NO_CLUSTER
Content Gateway Cache Type : LRAW_DISK
Cache Disk : /dev/sdb
Total Cache Partition Used : 1
*******************
* W A R N I N G *
*******************
CACHE DISKS LISTED ABOVE WILL BE CLEARED DURING INSTALLATION!! CONTENTS OF THESE DISKS WILL
BE COMPLETELY LOST WITH NO CHANCE OF RETRIEVAL.
Installer CANNOT detect all potential disk mirroring systems. Please make sure the cache
disks listed above are not in use as mirrors of active file systems and do not contain any
useful data.
Do you want to continue installation with this configuration [y/n]?

If you want to make changes, enter n to restart the installation process at the first prompt. To continue and
install Content Gateway configured as shown, enter y.

Important
If you enter y to proceed but you decide you want to cancel the installation, do not attempt to
quit the installer by pressing Ctrl-C. Allow the installation to complete. Then uninstall it.

18) Wait for the installation to complete.

Note
The subscription key is shared automatically with Content Gateway when it is entered in the
Forcepoint Security Manager.
If you receive an email from Content Gateway (to the address you specified during
installation) with “WCG license download failed” in the subject line, this alert does not mean a
problem occurred with the installation. The alert indicates that your deployment may require
you to manually enter the subscription key in the Content Gateway manager.

19) When installation is complete, reboot the Content Gateway server.

20) When the reboot is complete, check Content Gateway status with:
/opt/WCG/WCGAdmin status
All services should be running. These include Content Cop, Content Gateway, Content Gateway Manager,
and Analytics Server.

42
Forcepoint Web Security On-prem v8.5.x | Installation Guide

Next steps
After you have installed all of the software instances of Content Gateway needed for your deployment, continue
with Step 12: Initial Configuration.

Related concepts
Step 12: Initial Configuration on page 43

Step 11: Post installation activities

After you have finished installing components, refer to the following to ensure that your Web Security installation
is complete.
If multiple Policy Servers were installed and assigned to the same Policy Broker, and any of them reside on a
Microsoft Windows 2016 server, some of the services on all of the Windows 2016 machines in the deployment
may fail to restart at the end of the install process.
Log on to each machine and restart the following services as needed:
■ Websense Event Message Broker
■ Websense Cloud App Service
■ Websense Bridge Service
■ Websense SIEM Connector
Optionally, reboot each machine.

Step 12: Initial Configuration

Tip
All web protection tools and utilities installed on Windows Server platforms (such as [Link]
and [Link]), as well as text editors used to modify configuration files (such as
[Link]), must be run as the local administrator. Otherwise, you may be prevented from
running the tool or the changes you make may not be implemented.

43
Forcepoint Web Security On-prem v8.5.x | Installation Guide

Enter your subscription key

Before you begin

After installation is complete, log on to the Forcepoint Security Manager (console) and enter your
subscription key. Entering the key:
■ Allows your product to be verified
■ Initiates database downloads that activate your solution
■ Enables several management console features.

To get started:

Steps
1) If administrators use Internet Explorer to access the console, make sure that Enhanced Security
Configuration (IE ESC) is disabled on their machines.

2) Use a supported browser to launch the console and log on using the default account (admin) and the
password created during installation.
The console URL is:
[Link]

Here, <IP_address> is the IP address of the management server.

3) Enter your subscription key or keys. At first startup:

■ The Web module of the console prompts for a subscription key in the Initial Setup Checklist. This key is
automatically applied to Content Gateway.
■ If you have purchased the Forcepoint Web Security DLP Module, the Data module of the console also
displays a subscription key page.
Enter your subscription key and save the change in both consoles.

4) If you did not provide SMTP server details during installation, use the Global Settings > Notifications page
to specify the SMTP server used to enable administrator password reset functionality and account change
notifications.

5) Once the Web and (optionally) Data modules of the console show that your key has been verified, log off of
the console and log back on to see all of your subscribed features.

Confirm Content Gateway registration with

Forcepoint DLP
If you have purchased the Forcepoint Web Security DLP Module, Content Gateway registers with Forcepoint DLP
automatically. To ensure that registration is successful:

44
Forcepoint Web Security On-prem v8.5.x | Installation Guide

2) Navigate to the Data > Settings > General > Linking Service page.

3) Verify settings and test the connection.

Select Help > Explain This Page for detailed information about the settings on this screen.

4) Click OK to save any changes.

5) Click Deploy to deploy your settings.

Set Up Content Gateway

■ Log onto the Content Gateway manager and run a basic test (Getting Started)
■ If there are multiple instances of Content Gateway, consider configuring a managed cluster.
■ Configure protocols to proxy in addition to HTTP: HTTP (SSL Manager), FTP
■ Complete your explicit or transparent proxy deployment
■ Content Gateway explicit and transparent proxy deployments
■ In Content Gateway Manager Help: Explicit proxy, Transparent proxy
■ If proxy user authentication will be used, configure user authentication. Alternatively, you can configure
Forcepoint Web Security user identification.
■ Configure the real-time Scanning Options in the Web module of the Forcepoint Security Manager.
■ If you enabled content caching during installation, configure content caching.
After the base configuration has been tested, consider these additional activities:
■ If you are using HTTPS (SSL Manager), use the Web module of the Security Manager to configure categories,
clients, and destination servers for SSL decryption bypass
■ Create Content Gateway filtering rules to:
■ Deny or allow URL requests
■ Insert custom headers
■ Allow specified applications, or requests to specified websites to bypass authentication
■ Keep or strip header information from client requests
■ Prevent specified applications from transiting the proxy
■ In explicit proxy deployments, customize the PAC file.
■ In transparent proxy deployments, use ARM dynamic and static bypass, or use router ACL lists to bypass
Content Gateway (see your router documentation).
■ The ARM (Adaptive Redirection Module) module of Content Gateway uses a firewall. To facilitate interception
and redirection of traffic:
■ IPTables rules are configured during installation of Content Gateway.
■ Forcepoint IPTables chains are inserted.
■ Forcepoint IPTables rules are also inserted into existing chains.
■ Forcepoint chains and rules use “NC_” as a prefix for identification purposes.
■ IPTables rules configured outside of the Content Gateway manager must:
■ Be inserted after Forcepoint rules
■ Never be added to Forcepoint chains

47
Forcepoint Web Security On-prem v8.5.x | Installation Guide

■ Forcepoint chains and rules should never be edited.

■ If customized chains or rules impact the Forcepoint configuration, navigate to /opt/wcg/bin and execute
the following to re-establish the Forcepoint IPTables chains and rules:
[Link] -r

48