Lab 2 Training Environment Addressing Structure Build Out

Lab 2 Training Environment “Addressing Structure Build Out”

Table of Contents

REVIEWER INSTRUCTIONS / IT REQUIREMENTS:

Objectives

Duration: 40-50 minutes (in pairs)

Prerequisite Configurations

Training POD: Components and Networks

Implementation Notes:

V10000 Domains: V10000 DomUs (WCG & Filter Svc)

VM Requirements for Deployment Labs

Connecting to the Access Infrastructure

Logging In and Accessing VMs

POD Credentials & Keys

Key for Training

Connecting to the V10000 Console

Part 1a: Configure V10000 Network Interfaces

Verify/Enter a valid WCG DomU subscription key

Initiate WCG Database download (V10000 DomU)

Configure/Verify V10000 Portal for Websense Manager

Verify Dbase Download (??? WWS Domu ???)

Part 1b: Configure V10000 as Policy Server on WS Manager

Configure the V10000 Policy Server & Verify Database download (WWS)

Part 1c: Validate the WWS VM and WSG-x VM (basic operations)

Verify WSG-3 VM (basic operations)

Validate the WWS VM policy settings

Client 1 and Client 2 Configurations (WWS VM and WSG- 3VM)

Validate WWS VM is Filtering XP2 Client 1

Troubleshooting: No Block Pages for any (listed) category

Verifying authentication via the block page from WWS VM

(OPTIONAL) Part 1d: Validate all three gateways (WSG-1, WSG-2, WSG-3)

Verify WSG-1 and WSG-2 VMs (basic operations)

Verify Clients are blocked according to amended policy on WWS VM

Part 2 - Configure the V10000 & Verify Database download (WWS)

Verify the WCG Domu Database was downloaded & valid

If download has failed to initiate: Restart the WCG Module

REVIEWER INSTRUCTIONS/ IT REQUIREMENTS:

Reviewers:

-Sean Furey – v5K and v10K

-Tim Hurley – Filter

-Meliza Sanchez- Proxy

-Ofer Yarom– DSS

-Rose Liszikam- Hybrid

-Matt Sturm – overall

This sequence of operations must be tested/validated including three recent requirements:

1) minimize/mitigate delays if a WS d-base download is required for the v10k’s during class; 2) Group A and Group B will alternate between v10000-1 and V10000-2; 3) Include screenshots in case equipment/network problems occur during class (to enable instructor to talk through demo’s). As a reviewer, we are hoping to obtain expert feedback RE: WS products/deployments, DC/AD configurations, and specific implementations created for the POD environment (supporting 60+ students, per lab session).

Lab 2 begins with verification the v10k’s have a fresh dbase version before performing POD validations.

To do this, we intend to a) Examine v10ks to determine they have fresh d-bases and, if not, b) immediately initiate download/update. Next, c) continue validation of the WWS VM, DC VM, WSG-x VMs, and XP2 Client_xVMs are functional (e.g. amended default policy, client proxy thru WSG-3 VM, etc.). Finally, d) return to v10ks to verify fresh d-base was downloaded/updated successfully. Rationale: validate the POD and identify if problems exist asap, and correct issues.

IT REQUIREMENTS:

BEFORE SHIPPING PODS TO HOTEL: REPEAT ALL STEPS for both V10000-1 and V10000-2; THEN CAPTURE THEIR BASELINE FROM END OF LAB 2 :
CONFIG FOR STATE ZERO UP TO END OF LAB 2: All V10ks
VERIFY with Tom/Dan: Exising VM Baseline 1 (from 1222/09) is acceptable for kick-off

Finally, items contained in “????RED ???” indicate outstanding questions and key issues, some of which you may have insight or answers or may be able to confirm as true or false.

Thank you for taking time to assist in this review!

– Chris Dotson, x18016 (Call any time for questions or to discuss this review)

Objectives

Duration: 40-50 minutes (in pairs)

These lab exercises ensure you have: Full access to your assigned training POD, navigate within the training environment (VMware, PODs), and validate your initialVM configurations (DC, WWS, WSG), and the V10000 Appliance (DomUs).

The sequence of operations (Lab 2 and Lab 3) is intended to minimize delayswhich can result from downloading the Websense Database. Intentionally, the sequence of operations is NOT optimized for standard installations.You must complete Lab 2 and configure all required elements prior to performing any of the additional labs.

During this lab you will validate your training environment, as follows:

Lab 2 validates the baseline configuration is functioning 100% in the hotel environment (e.g. verifies the WWS VM and WS Mgr GUI are config’d and “talking” to wsg-3 VM, i.e. both are functioning as proxy/filter for client 1 and 2 requests).

Notice: The amended policy is automatically applied to all clients on 172.31.0.1 (Travel = Quota, Sports = Blocked, Real Estate = Confirm); Later, during Lab 3 you will configure several features of the POD.

During Lab 3, students begin with V10000 “on-box” (DomU) configuration, configure client 1 and 2, before they validate client proxy through V10k-1 (P1). After clients receive a block page, students validate the block page URL was issued by the correct V10000-x (i.e. the DomU assigned for filter, policy, and which responds to either was issued by ?????172.31.100.110 , or 172.31.100.12) ?????????; it should be the C interface ???) .

Prerequisite Configurations

Lab2 and Lab 3 requires all POD components (WWS, WSG-x VM’s, Client VMs, V10000 Appliances, switches and routers) to be properly configured prior to class-start, as follows:

All networking and VMware infrastructure fully configured and operational, as required to supported connectivity between student PC’s and each POD component, including all inter-POD network communications, as per POD diagram.
WWS VM pre-configured and fully operational ( valid license key, fresh database, processing database updates, amended default policy for categories, and capable of processing client http, https and ftp requests issued via the WSG-3 VM).
WSG-x VMs pre-configured and fully operational ( valid license key, fresh database,processing database updates, and capable of processing client http, https and ftp requests).
WSG-x VMs Free disk space (less than 95% used, as per “df –k”).
V10000-1 and V10000-2 systems are operational and pre-loaded, including: All standard firstboot settings, P1 and P2 configured/enabled, valid license key, fresh database, and processing database updates.

DC VM fully functional and capable of authenticating clients within the WSTRAIN.com doman.
XP2 Client 1 and XP2 Client 2 fully operational and preloaded with standard training applications (IE, PuTTY, WinSCP, Websense VPN client)

Training POD: Components and Networks

Figure: Diagram - POD Components and Networks (VLANs, interfaces/IPs)

Implementation Notes:

For the Deployment Class, the diagram reflects all POD interconnects and includes V10000 G1 Appliances (G2 Appliances do not have DRAC interfaces), including:

The DC VM is pre-configured to rely DNS Forwarding for in-house Websense DB Server(fast, localservice for DB updates/downloads to PODs)
Within each POD, V10000 -1 and V10000 -2 (IP addresses, as shown)
Pod A = 1-30 and Pod B = 31 – 60 will share uplink address space:

10.64.64.201 – 10.64.64.230 (shared by Group A and B throughout these labs).
POD1 and POD 31 = 10.64.64.201 (both PODS not active concurrently)
POD2 and POD 32 = 10.64.64.202 (both PODS not active concurrently)

......

POD30 and POD 60 = 10.64.64.230 (both PODS not active concurrently)

Group A: Pods A1 – A30 (VLANS POD# X 10 + 1.2.3.4)

Group B: Pods B1 – B30 (VLANS POD# X10 + 5,6,7,8)

60 active sets (concurrently): POD VMs on POD1A-POD30A and POD1B-POD30B
Shared Router (3725 Router): For each group (A and B), Labs 8, 9, and 10 utilize the router (Note: Router configurations, “state” will be restored prior to Group A and B exercises)
V10000-1 and -2 will be pre-configured (firstboot), then pre-loaded, as per these lab exercises (e.g. config’d with fresh d-bases, keys pre-loaded, all DomUs pre-configured, as per diagram and Lab 2, Part 1 Instructions, below).

Each POD, all POD VM’s restored to “baseline 1” to simulate Training/Student environment
Example: Ping 10.64.64.232 (example shows instructor POD 32 or POD 62; egress thru3725 Router)

V10000 Domains: V10000 DomUs (WCG & Filter Svc)

Refer to tables, below, for detailed IP Address for each V10000 interface.

Dom 0: Appliance management functions (Patch, SSH, Serial, etc.)
DomUs: Modules (WCG, NA, Filter, etc.)

Figure: V10000 Dom0 and DomUs (WCG, and Filter/Policy, etc.)

V10000 Sections of Lab 2 and Lab 3 prepare our DomU’s (WCGFiltering), before validating “on-box”, then “off-box” proxy/filter services.

Figure: V10000 DomUs (WCG, and Filter/Policy, etc.)

VM Requirements for Deployment Labs

VMs Required / Software Deployment / Operating System / Rel / File VM Name
DC-WSG
(Domain Controller – DNS, AD wstrain.com) / 1 GB / Windows Server2003 R2 / SP2 / DC for WSG
WWS-WSG
(WWS, SQL Log Server/Websense Manager / 4GB / Windows Server 2003 R2 / SP2 / WWS for WSG
XP2 Client 1 / 256M / Windows XP w Explorer 7 / SP 2 / XP CLIENT 1
XP2 Client 2 / 256M / Windows XP w Explorer 7 / SP 2 / XP CLIENT 1
WSG-1 / 2GB / Centos / 4.5 / WCG for WSG
WSG-2 / 2GB / Centos / 4.5 / WCG for WSG
WSG-3 / 2GB / Centos / 4.5 / WCG for WSG

Connecting to the Access Infrastructure

The servers and V10000 Security gateways used for this training are hosted by Websense and are locally installed within the hotel. You mustuse your own (student) PC to connect to the training environment within the hotel. You will then launch the VMware vCenter Lab Manager to complete all subsequent labs.At this time, complete the following steps:

Locate and record the wireless network: ______(???? COPY key slides from the Intro Lab and re-write this section ; What are student access requirements at hotel ??is this an outdated requirement ????? ?)
Use WEP Key provided by your instructor. Enter WEP key: ______
Enter the user name and password provided by your instructor.

Username: ______Password: ______

In the next section you will verify connectivity to the lab environment.

Logging In and Accessing VMs

From your PC browser, enter the following URL and verify connectivity to the VMware vCenter Lab Manager:

REVIEWERS: I used: ; cdotson/Websense1

A user-specific Pod # must be assigned by the instructor for each student.

For all subsequent labs, you must log in only using your assigned username and

password.

Record your logon credentials and assignedpod number, and login to the VMware vCenter Lab Manager.

***PLEASE DO NOT MODIFY ANY PASSWORDS USED DURING THESE TRAINING SESSIONS.

UserName / Pod# / Password
Websense1

Figure: Username, POD#, Password assignments for POD Access

Figure: VMware vCenter Manager - Login

Continue and ignore the security warning.

The following POD Configurations configured all students attending these labs

(informational-only):

Figure: VMware/VLAN Configure for Deployment Labs (Kick-Off implementation)

If you were not able to access and login to each of seven (7) VMs, then clear the IE cache and refresh the screen. If you are still unable to login to each VM Console, immediately notify the instructor.

Then, log-off VMware vCenter Lab Manager and logon, again.

The following screen appears, indicating seven (7) VM instances required for Deployment labs.

If you are unable to login to each VM Console, clear the IE cache and refresh the screen. If you are still unable to view and login to each VM Console, immediately notify the instructor. Then, log-off VMware vCenter Lab Manager and logon, again.

Two students per POD: Please follow the lab, step-by-step, coordinating each task when configuring all POD components.Most instructions assume only XP2 Client 1 VM for datan-entry, however students may coordinate team efforts to perform tasks in parallel (both client 1 & 2 VMs). In preparation for future labs, the following lab exercises are required to configure each V10000.

At start of each lab exercise, need to ensure all VM’s date/time are set correctly,

i.e. date of WCG’s must match WWS. An NTP server is specified during the lab.

POD Credentials & Keys

Throughout these labs, the following login credentials will be pre-configured.

Unless instructed during a lab exercise, please do not modify passwords during any of

these labs.

XP2 Client 1 and XP2 Client 2 Login Credentials:

Username / administrator
Password / Websense1

Active Directory (Native Mode) Login Credentials:

Username / WSTRAIN1\administrator
Password / Websense1

V10000 GUI (appliance management) Login Credentials:

Username / admin
Password / Websense1

Zen Domain Login Credentials:

Username / root
Password / Websense1

DC Login Credentials: ????re-verify ????????

Username / WebsenseAdministrator
Password / Websense1

Websense Manager Login Credentials:

Username / WebsenseAdministrator
Password / Websense1

WCG Management Login Credentials:

Username / admin
Password / Websense1

Key for Training

For training purposes only, the following subscription key is required to configure each component (WWS, WCG, and V10K): TST7TAVMS5S9Q2R2

Connecting to the V10000 Console

During this lab, you will verify the V10000 Appliance network interfaces are configured correctly. Prior to this lab exercise, the V10000 Appliance has been pre-configured, including: 1) Reloading the V10000 appliance software, 2) Configuring firstboot settings and License key, and 3) a “fresh” database waspreviously downloaded (less than 14days old).

By default, the Websense Content Gateway runs on the V10000 P1 Interface.

After we verify the basic each of the VMs, below, Lab 3 exercises will have you reconfigureXP2 Client 1 andXP2 Client 2 toproxy thru the V10000-1 (P1 Interface).

VM / IP / Port / Services
WWS / 172.31.100.13 / :9443 / WS Manager
WSG-3(WCG) / 172.31.100.14 / :8081 / WCG Mgr (Proxy)
WSG-2(WCG) / 172.29.1.20 / :8081 / WCG Mgr
WSG-1(WCG / 172.29.1.30 / :8081 / WCG Mgr (PAC Script)
XP2 Client 1 / 172.31.100.30 / IE, WinSCP, PuTTY
XP2 Client 2 / 172.28.1.30
DC / 172.31.100.12 / (DNS, AD)

Group A:

Description / IP / Port / Service
V10000-1 (C) / 172.31.100.110 / :9447 / V10000 Logon Portal
V10000-1 (P1) / 172.30.1.111 / :8081 / WCG Manager

Group B:

Interface / IP / Port / Service
V10000-2 (C) / 172.31.100.120 / :9447 / V10000 Logon Portal
V10000-2 (P1) / 172.30.1.121 / :8081 / WCG Manager

The P1 interface requires internet access, e.g. download analytic databases.

V10000-1 (GROUP A ONLY)

Use the following information to configure network interfaces for V10000-1. Use 172.31.100.110:9447 to launch the V10000 Console for V10000-1.

IP Address / 172.31.100.110
Subnet Mask / 255.255.0.0
Default Gateway / 172.31.0.1 Cisco 3725 fe0/0
Primary DNS / 172.31.100.12

IP Address / 172.30.1.111
Subnet Mask / 255.255.255.0
Default Gateway / 172.30.1.1 Cisco 3725 fe1/1
Primary DNS / 172.31.100.12

IP Address / 172.30.1.112
Subnet Mask / 255.255.255.0
Default Gateway / 172.30.1.1 Cisco 3725 fe1/1
Primary DNS / 172.31.100.12

V10000-2 (GROUP B ONLY)

Use the following information to configure network interfaces for V10000-2. Use 172.31.100.120:9447 to launch the V10000 Console for V10000-2.

IP Address / 172.31.100.120
Subnet Mask / 255.255.0.0
Default Gateway / 172.31.0.1 Cisco 3725 fe0/0
Primary DNS / 172.31.100.12

IP Address / 172.30.1.121
Subnet Mask / 255.255.255.0
Default Gateway / 172.30.1.1 Cisco 3725 fe1/1
Primary DNS / 172.31.100.12

IP Address / 172.30.1.122
Subnet Mask / 255.255.255.0
Default Gateway / 172.30.1.1 Cisco 3725 fe1/1
Primary DNS / 172.31.100.12

Use the diagrams and tables provided (above) when configuring each V10000

Appliance in the POD.At this time, connect to the V10000 Console, as follows:

Each step is intended to be performed from the first client (XP2 Client 1 VM).

Each pair of students work parallel (in teams) only for certain tasks –Students mustcarefully coordinate their activities and config changes within the POD and VMware vCenter.

The following lab exercises are required to configure the V10000.

Open Internet Explorer and connect to the V10000-x by entering the following URL:

Where “172.31.100.xxx” is:172.31.100.110 for the V10000-1 C interface, and 172.31.100.120 for the V10000-2 C interface.

Click Yes, if you receive a popup security warning and Continue to this website

Figure: V10000 Logon Portal options

Launch the V10000 Console and logon: admin/Websense1

Figure: V10000-1 (Controller: 172.31.100.110:9447) - Console Logon

Part 1a: Configure V10000 Network Interfaces

Note: For these labs, the V10000 should be pre-configured and “fresh” WS database downloads should have been completed. Simply verify all settings, as per POD diagrams (and tables, above).

From the V10000 Console, go to Configuration->Network Interfaces, and verify/enter the configuration for the V10000 Controller Interface C.

If settings were modified, click the Save button (located on the right side of this section)

Verify/enter the configuration for the Websense Content Gateway Interfaces (configure both P1 and P2).

Verify/Check “Enable . . .” second interface for the proxy.

The N interface is not used for these labs.

Click the Save button (located on the right side of P1/P2 section)

The update may take several minutes.

After any interface modifications were confirmed, verify they are both successfully applied, for exampe“ P1 interface has been updated” (top, left, located next to the).
Re-verify all settings using the POD Diagram (and tables), as indicated for Group A and Group B (example:Group A = V10000-1; Group B = V10000-2).

Figure: Example - Network Interfaces for V10000-1

It’s easy to enter this info.Incorrectly: Ensure all settings match screenshot, after saving for both C Interface and P1 and P2 sections.NOTE: After Savingthe (C) and (P1 and P2) sections, re-fresh your screen. Then, re-verify settings match the VM screen shot, as shown.

Next, on XP2 Client 1, open a separate IE browser and verify (basic)P1 connectivity:
Enter theURL to access the Websense Content Gateway Manager GUI via the P1 interface with the default port: 8081, as follows.

Group A (V10000-1 P1):

Group B (V10000-2 P1):

Click Continue to this website
Login to the WCG Manager using the default credentials: admin/Websense1

Figure: V10000-1 (P1) WCG Manager (URL: 172.30.1.111:8081)

Verify/Enter a valid WCG DomUsubscription key

From the XP2 Client 1 Internet Explorer, enter the corresponding URL to access the V10000 P1 (accesses DomuWCG Manager).

Group A:
Group B:

If prompted click Continue to this website link

In the Websense Content Gateway, go to My Proxy > Subscription and verify/enter the license key provided by your instructor.

For training purposes only, the following subscription key is required to configure each component (WWS, WCG, and V10K): TST7TAVMS5S9Q2R2

If no changes, skip to next step. If you made any changes above, then:

Click the Apply button

Go toConfigure > My Proxy > Basic and click Restart

Under Monitor > My Proxy >Summary verify all three WCG features have a status ofPurchased. This validates the license key is linked correctly.

The Scanning Data files section will display old (stale) data until the update

procedure has completed (after update, Data File Version will not bea “0”).

Initiate WCG Database download(V10000 DomU)

Both Websense Web Security and Websense Content Gateway (WCG) must connect to the Websense download site to receive the latest version of the databases used for categories and real-time scanning.