Content Gateway Manager Help Websense® Content Gateway v8.0.x ©1996–2014, Websense Inc. All rights reserved. 10900 Stonelake Blvd, 3rd Floor, Austin, TX 78759, USA Websense Content Gateway Online Help November 2014 R050914800 This document contains proprietary and confidential information of Yahoo, Inc and Websense, Inc. The contents of this document may not be disclosed to third parties, copied, or duplicated in any form, in whole or in part, without prior written permission of Websense, Inc. Every effort has been made to ensure the accuracy of this manual. However, Websense Inc., and Yahoo, Inc. make no warranties with respect to this documentation and disclaim any implied warranties of merchantability and fitness for a particular purpose. Websense Inc. shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice. Use, duplication, or disclosure of the technical data contained in this document by the Government is subject to restrictions as set forth in subdivision (c) (1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 52.227-7013 and/or in similar or successor clauses in the FAR, or in the DOD or NASA FAR Supplement. Unpublished rights reserved under the Copyright Laws of the United States. Contractor/manufacturer is Websense, Inc, 10900 Stonelake Blvd, 3rd Floor, Austin, TX 78759, USA. Trademarks Websense, the Websense Logo, ThreatSeeker, and TRITON are registered trademarks of Websense, Inc. in the United States and/or other countries. Websense has numerous other unregistered trademarks in the United States and internationally. All other trademarks are the property of their respective owners. Portions of Websense Content Gateway include third-party technology used under license. Notices and attribution are included elsewhere in this manual Traffic Server is a trademark or registered trademark of Yahoo! Inc. in the United States and other countries. Red Hat is a registered trademark of Red Hat Software, Inc. Linux is a registered trademark of Linus Torvalds. Microsoft, Windows, Windows NT, and Active Directory are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Mozilla and Firefox are registered trademarks of the Mozilla Foundation. Netscape and Netscape Navigator are registered trademarks of Netscape Communications Corporation in the United States and in other countries. UNIX is a registered trademark of AT&T. All other trademarks are property of their respective owners. Contents Contents Topic 1 Overview . 1 Deployment options . 2 SSL inspection . 2 As a Web proxy cache. 3 In a cache hierarchy. 4 In a managed cluster . 4 As a DNS proxy cache . 4 Components . 4 Cache. 4 RAM cache . 5 Adaptive Redirection Module . 5 Host database. 5 DNS resolver. 6 Processes. 6 Administration tools . 7 Proxy traffic analysis features . 7 Online Help . 8 Technical Support. 8 Topic 2 Getting Started . 11 Accessing the Content Gateway manager . 11 Configuring Content Gateway for two-factor authentication . 13 Accessing the Content Gateway manager if you forget the master administrator password . 15 Entering your subscription key. 16 Providing system information . 16 Verifying that the proxy is processing Internet requests . 17 Using the command-line interface . 18 Starting and stopping Content Gateway on the Command Line . 19 The no_cop file . 19 Topic 3 Web Proxy Caching . 21 Cache requests . 21 Ensuring cached object freshness . 22 HTTP object freshness . 22 FTP object freshness . 26 Scheduling updates to local cache content . 27 Configuring the Scheduled Update option . 28 Forcing an immediate update . 28 Pinning content in the cache. 29 Online Help i Contents Setting cache pinning rules . 29 Enabling cache pinning . 30 To cache or not to cache? . 30 Caching HTTP objects . 30 Client directives . 31 Origin server directives . 32 Configuration directives . 34 Forcing object caching . 36 Caching HTTP alternates . 36 Configuring how Content Gateway caches alternates. 36 Limiting the number of alternates for an object . 37 Caching FTP objects. 37 Disabling FTP over HTTP caching. 38 Topic 4 Explicit Proxy . 39 Manual browser configuration . 39 Using a PAC file. 40 Sample PAC file . 41 Using WPAD . 42 Configuring FTP clients in an explicit proxy environment . 43 Topic 5 Transparent Proxy and ARM . 47 The ARM . 48 Transparent interception strategies . 49 Transparent interception with a Layer 4 switch . 49 Transparent interception with WCCP v2 devices . 50 Transparent interception and multicast mode . 66 Transparent interception with policy-based routing . 67 Transparent interception with software-based routing . 68 Configuring Content Gateway to serve only transparent requests . 69 Interception bypass . 70 Dynamic bypass rules . 71 Static bypass rules . 72 Viewing the current set of bypass rules . 73 Connection load shedding . 73 Reducing DNS lookups . 74 Topic 6 Additional Proxy Configuration . 77 IP spoofing . 77 Range-based IP spoofing. 78 IP spoofing and the flow of traffic . 79 Configuring IP spoofing . 80 Support for IPv6 . 82 ii Websense Content Gateway Contents IPv6 configuration summary. 83 Topic 7 Clusters. 85 Management clustering . 86 Changing clustering configuration . 86 Adding nodes to a cluster . 89 Deleting nodes from a cluster . 91 Virtual IP failover. ..