Quick Start for Network Agent 5-Step Quick Start See - Websense ...
Quick Start for Network Agent 5-Step Quick Start See - Websense ...
Quick Start for Network Agent 5-Step Quick Start See - Websense ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
<strong>Quick</strong> <strong>Start</strong> <strong>for</strong> <strong>Network</strong> <strong>Agent</strong>Spanning or mirroring has not been turned onThe switch port connected to the <strong>Network</strong> <strong>Agent</strong> machine must see all traffic.On most switches, you can change the port mode to spanning, mirroring, or monitoring mode (theterm varies with the manufacturer; the function is the same). Cicso uses the term spanning. 3Com,DLink, and others use mirroring. HP and some other manufacturers call it monitoring.To connect <strong>Network</strong> <strong>Agent</strong> to the network using a switch, plug the <strong>Network</strong> <strong>Agent</strong> machine into theport on the switch that mirrors (spans, monitors) the traffic going to the gateway or firewall port.The span port mirrors all the traffic that leaves the network segment, so traffic is simultaneously sentto the monitoring port to which <strong>Network</strong> <strong>Agent</strong> is connected.Spanning or mirroring is set on the wrong portMonitor (span, mirror) only the port going to the firewall or router port, not the entire network.Router or Firewall traffic is being monitored in the wrong directionMonitor (span, mirror) the traffic going to the firewall/router. On Cicso switches, this means you needto specify Tx. On HP and 3Com switches, you need to specify Egress.To log bytes sent and received, set both Tx and Rx (Cisco) or both Egress and Ingress (HP, 3Com).Mono-directional spanning (mirroring, monitoring) is used with a single NIC<strong>Websense</strong> strongly recommends using a switch that supports bi-directional spanning. If such a switchis used, <strong>Network</strong> <strong>Agent</strong> can function successfully with a single <strong>Network</strong> Interface Card (NIC)per<strong>for</strong>ming both monitoring and blocking.If the switch does not support bi-directional spanning, <strong>Network</strong> <strong>Agent</strong> must use separate NICs <strong>for</strong>monitoring and blocking.How do I set up <strong>Network</strong> <strong>Agent</strong> on a machine with teamed NICs (TNICs)?TNICs share the load under one common identity, with four adapters load-balancing under a single IPaddress. This is also known as link aggregation or trunking.<strong>Websense</strong> recommends against using teamed NICs <strong>for</strong> <strong>Network</strong> <strong>Agent</strong>.An anti-spoofing mechanism has been used in the switchEither disable the anti-spoofing mechanism or contact <strong>Websense</strong> Technical Support <strong>for</strong> additionaloptions.Are other tools available <strong>for</strong> verifying that the <strong>Network</strong> <strong>Agent</strong> machine sees the traffic?Yes. Contact a <strong>Websense</strong> Technical Support specialist or Sales Engineer <strong>for</strong> in<strong>for</strong>mation aboutnetwork tools that can help verify <strong>Network</strong> <strong>Agent</strong> behavior.Can a network tap be used with <strong>Network</strong> <strong>Agent</strong>?Yes. A tap can be used with the <strong>Network</strong> <strong>Agent</strong> machine. <strong>Network</strong> <strong>Agent</strong> must be able to see thetraffic in both directions<strong>Quick</strong> <strong>Start</strong> 17 <strong>Network</strong> <strong>Agent</strong>