Quick Start for Network Agent 5-Step Quick Start See - Websense ...

Quick Start for Network AgentSpanning or mirroring has not been turned onThe switch port connected to the Network Agent machine must see all traffic.On most switches, you can change the port mode to spanning, mirroring, or monitoring mode (theterm varies with the manufacturer; the function is the same). Cicso uses the term spanning. 3Com,DLink, and others use mirroring. HP and some other manufacturers call it monitoring.To connect Network Agent to the network using a switch, plug the Network Agent machine into theport on the switch that mirrors (spans, monitors) the traffic going to the gateway or firewall port.The span port mirrors all the traffic that leaves the network segment, so traffic is simultaneously sentto the monitoring port to which Network Agent is connected.Spanning or mirroring is set on the wrong portMonitor (span, mirror) only the port going to the firewall or router port, not the entire network.Router or Firewall traffic is being monitored in the wrong directionMonitor (span, mirror) the traffic going to the firewall/router. On Cicso switches, this means you needto specify Tx. On HP and 3Com switches, you need to specify Egress.To log bytes sent and received, set both Tx and Rx (Cisco) or both Egress and Ingress (HP, 3Com).Mono-directional spanning (mirroring, monitoring) is used with a single NICWebsense strongly recommends using a switch that supports bi-directional spanning. If such a switchis used, Network Agent can function successfully with a single Network Interface Card (NIC)performing both monitoring and blocking.If the switch does not support bi-directional spanning, Network Agent must use separate NICs formonitoring and blocking.How do I set up Network Agent on a machine with teamed NICs (TNICs)?TNICs share the load under one common identity, with four adapters load-balancing under a single IPaddress. This is also known as link aggregation or trunking.Websense recommends against using teamed NICs for Network Agent.An anti-spoofing mechanism has been used in the switchEither disable the anti-spoofing mechanism or contact Websense Technical Support for additionaloptions.Are other tools available for verifying that the Network Agent machine sees the traffic?Yes. Contact a Websense Technical Support specialist or Sales Engineer for information aboutnetwork tools that can help verify Network Agent behavior.Can a network tap be used with Network Agent?Yes. A tap can be used with the Network Agent machine. Network Agent must be able to see thetraffic in both directionsQuick Start 17 Network Agent