Websense Community

SkyDrive - How to approve on your network

atardio — Wed, 16 May 2012 16:41:01 GMT

After some heavy investigation there are 2 secure servers Microsoft uses for SkyDrive. I couldn't find any proper documentation on the forums about this so here is some more info...

1. SkyDrive - web service. This is simply their web service that you can log into at https://skydrive.live.com - In order to allow this you need unblock: https://65.55.124.223 (by default Websense blocks this under Social Networking)

2. SkyDrive - app service. If you download their app to run locally you need to unblock: https://207.46.0.175 - This needs unblocked because the service will just keep trying to sign in unsuccessfully because it can't reach the server. There is no error from the app either, the icon will just keep showing "signing in"

Hope this helps, let me know if you have any suggestions or other questions.

No more traffic allowed after authentication problem

alex34 — Fri, 11 May 2012 14:09:38 GMT

Hello,

I have the Integrated Windows Authentication and every 2/3 days I have the following errors on my WCG (/var/log/messages) :

May 7 15:21:43 fprx01 content_gateway[4088]: WARNING: winauth: Auth queues are full - FAILED to get NTLM helper after 10 tries
May 7 15:21:43 fprx01 content_gateway[4088]: ERROR: winauth failure: auth_error_ntlm HELPER_FAIL_NTLM (client ip:Citrix_server117)
May 7 15:21:48 fprx01 content_gateway[4088]: WARNING: winauth: Auth queues are full - FAILED to get NTLM helper after 10 tries
May 7 15:21:48 fprx01 content_gateway[4088]: ERROR: winauth failure: auth_error_ntlm HELPER_FAIL_NTLM (client ip:Citrix_server116)
May 7 15:21:48 fprx01 content_gateway[4088]: WARNING: winauth: Auth queues are full - FAILED to get NTLM helper after 10 tries
...

The consequence is that until I restart the websense service on my WCG I have no more traffic allowed.

What I do not understand is that The fail open authentication option is checked on my WCG.
So why traffic is not allowed even if there are some authentication problem ?

Thank you.

Hardware Requirements for WS 7.6.2

cfowler — Tue, 15 May 2012 18:40:05 GMT

Hey all;

Just curious to know if the opinions of others who have a Stand Alone configuration with Websense. We have a Windows 2008 R2 (64-bit) environment that we're running Websense Standalone v7.6.2. At present it's running within on a VM and the CPUs are taking a heck of a pounding. Everything is running on this server and of course the EIM & Network Agents are the ones pounding the CPUs. :)

I know the requirements call for 4 x 4core CPUs, at least 2.5GHz / each & 4GB of RAM and with a remote database, 7 GB of local disk.

Has anyone implemented a similar configuration and what were your findings? IE did you have to break out the Filter and Network agents to different boxes? Were the suggested number of CPUs enough, etc... ?

Appreciate any input.

re-subscribe automatically the EUMR

Ronaldo Ferreira — Fri, 13 Apr 2012 16:10:28 GMT

I would like re-subscribe using Directory Synchronization client.

leaving the option to user does not wish to receive.

Thank you

Alert When Log Server Stops Wrting to Database

wei — Tue, 17 Apr 2012 14:30:35 GMT

We have found often times, the log server stops writing to the database so the cache folder starts to fill up. We have to create a partition manually to restart the writing. We are not losing any data, but it will take a while to clear the cache. Can there be a feature that we will be alerted when this happens?

Thanks,

Wei

Citrix and websense policy configuration problem

AntWin — Wed, 16 May 2012 04:47:29 GMT

Hi,

I'm new to the whole Websense thing and am having a bit of an issue trying to find out why some policies dont seem to be applying on traffic from my Citrix servers properly.

I have a customer that needs to access YouTube. Obviously I dont want everyone else to so I have added this user into an AD group that is linked through to our V10000 Web Security Gateway (v7.5) console and should allow access to the streaming media category.

If the user logs on to an AD authenticated local desktop it works, log on to a Citrix published desktop or published IE session and it does not work it simply shows a Websense message detailing that the site is blocked due to policy.

If I run the test URL and policy tester on the Web Security console is shows the username as having permission to access but that the Citrix server is blocked from using that category. If I check which policies are applying to the citrix server it shows it as default and mentions that user permissions should override this.

I have checked the network and workstations sections of the clients area and the citrix servers are not explicitly specified anywhere there.

Is there somewhere else that I should be checking or another area for configurations?

Thanks.

Unblocking a URL doesn't work

WDIT — Tue, 27 Sep 2011 13:21:33 GMT

Hello,

I had entered an expression to unblock (cgtextures.com) and it was working fine until recently. Now even though the expression is still in the unblock list it gets blocked as Freeware / Software downloads. I don't know what would cause it to break. I removed it from the unblock list saved the config and then entered it again thinking that would get it going again, but it still gets filtered. I also tried to recategorize it into a category that is not blocked, but that did work either.

I don't want to have to open up an entire category just for one site. I would really appreciate it if anyone has any ideas on how to get this site unblocked. Thank you in advance.

Websense apply default policy on all user's

itsecurity — Tue, 15 Mar 2011 07:34:44 GMT

Dear All,

Websense apply default policy on user's , please find below for better understanding issue:-

For user identification we have applied manual authentication secondly everthing would be fine for next with in min websense unable to filter the Website and categorized all sites in "Network error" , then we restart the Filering service then everything is working fine.

Second issue:- Websense applied default policy on all users and some tiime it prompt for user credentials but Websense not accept that and shows "Session timeout" then we restarted the User service and issue got resolved , then we analyze the Application events logs and found application warning error " error says Websense unable to get the group or user detail from DC.

We have continiously facing these issues , please suggest

Temporary Website Access

kscott — Fri, 04 May 2012 15:36:54 GMT

I would like to see a temporary website access tool added to the Web Security side of Websense. I have had many different situations where I need to allow a website, such as a file transfer website to be opened for one user, but not permanently. While there are more laborious ways to do this, it would be nice to have a quick tool to go to in order to open a website for a chosen amount of time, then have it revert back after that amount of time.

Want to allow video embedded in webpage.

DarkHawk — Tue, 15 May 2012 19:01:07 GMT

I'm using Web Filter 7.0, I need to allow videos on Google's Apps Learning Center:

http://learn.googleapps.com/training-videos

I have unblock streaming but the videos are still getting block and I can seem to pinpoint the problem. The videos seem to be originating from youtube , but I completly unblock it and the problem still persists. Can Anyone point me in the right direction? FYI the "Home" page has a embedded video as well and that says it's blocked by Social networking. I tried that and still no luck.

Notifying users that their email was released from spam queue

NazZaR — Thu, 03 May 2012 08:51:13 GMT

Recently i configured a notification in policy management, that the blocked email senders will receive.

How can i notify them that their email is reviewed and released from spam queue?

Thank you!

Websense Content Gateway alternatives?

Evan33517 — Tue, 01 May 2012 14:18:12 GMT

We're having typical issues with HTTPS traffic. We're not using Websense Content Gateway, so we must filter by IP address rather than the URL. While this works for most standard sites, it does not work for cloud hosted sites (Amazon Cloudfront, certain Google Maps sites, etc.).

Are there any alternatives to using Websense Content Gateway? Maybe something locally installed on each workstation that decrypts SSL on Websense's behalf? Any suggestions would be much appreciated.

Exporting to XLS broken

mlpotgieter — Thu, 03 May 2012 08:46:43 GMT

When exporting Investigative or Presentation reports to XLS, bandwidth and hits are in cells formatted as text. This means XLS formulas do not recognize them as numbers. To fix this one has to manually remove the "'" from the beginning of the number in each cell. One could probably use a formula or a few other ways to do this aswell but the point of exporting to XLS is to be able to manipulate the numbers and this seems to defeat that.

This has been broken for years but we are now in the process of importing monthly Websense reports into an custom reporting system and this just adds a step that should not be there in my opinion.

view all cases opened by my company

yann-gemalto — Wed, 11 Apr 2012 10:00:38 GMT

Hi, I would like to have the possibility to view all cases opened by my company in the support website, not only the cases I opened. Thanks

Make "session timeout" a user defined value in Webense Manager

gyi — Mon, 20 Jul 2009 18:20:29 GMT

Version 7 introduced a somewhat arbitrary timeout value 30 minutes for Websense Manager sessions. I would like to see this as a user-configurable parameter. I'm fine with it having a maximum value - I'd suggest eight hours. When I'm spending a lot of time going back and forth to Websense it's annoying to have to repeatedly log back in. I can see that part of this may be due to your design choice to limit how many users (that is, one) may be logged in with the Super Administrator role and also may be a problem with how you serialize updates. But- I'm sure you can find a way to make it work!

YouTube in Schools Integration

LFCDS — Thu, 15 Dec 2011 15:50:43 GMT

Recommend adding a configuration option to append an organization-specified URL parameter to all YouTube requests (both local and Remote Filter clients) to support YouTube in Schools:

http://support.google.com/youtube/bin/answer.py?hl=en&answer=1686318

Filtering Terminal Services Users

CMowl — Wed, 09 May 2012 19:57:35 GMT

Here is our environment, approximately 400 users about half on a Terminal Services farm and the other half running PCs or laptops. We have Cisco ASA firewalls, which has been integrated to a Websense filtering server. All PCs/laptop users are being filtered & logged appropriately.

Our issue is the Terminal Services users, we have a farm of about 10 Windows 2008 R2 Terminal/RDS Servers, all users need to be filtered and more specifically logged. We do not have Microsoft ISA or Proxy server in our environment. Our preferred option would of course just get logged through the ASA but I understand that won't identify the specific users.

I understand we should be able to use Squid as a proxy for the Terminal Servers, and stand up another Websense filtering server integrated with squid, running the DC agent on that box and capture the specific user information.

That said, squid is installed, all TS servers pointing to squid as the proxy which is integrated with a filtering service on a Windows box running DC agent. We are still not getting logging to work, the majority of the hits are being logged as the ip address of the squid server. What can be done to mitigate this? The logging is imparative for us. Why a simple plug-in doesn't exist a'la Citrix is baffling.

Note: We have Chrome, IE, & Firefox browsers and having the users authenticate with a username/password for squid is impratical and will not be an option in this environment

Yandex Search Filtering

ConalR — Fri, 11 May 2012 14:27:13 GMT

We currently have 'Search Filtering' enabled to filter out explicit images but this is not working with 'Yandex'. The other search engines are working OK. Is anyone else having a similar problem.

Thanks

Conal R

Limited Access Filter

Total Duffer — Fri, 11 May 2012 12:30:06 GMT

I understand that a limited access filter only grants access to a defined list of URL's. Is it possible to allow or block the ability to download a vaiety of file types in the same way you can with a regular category set?

Thanks

Export Policies spreadsheet not in a usable format

rlsmith999 — Tue, 22 Sep 2009 15:31:45 GMT

I sent in an official "enhancement request", but it seems WebSense will not provide a better or more readable output for their "export Policies" button.

I suggested, that instead of all the Categories and Protocols in a single line down the page (THOUSANDS of lines, and lots of extranious information), that it list the Categories down, and columns of Policies tabbed across the top. Similar to this example below: (This took me 4+ hours to manipulate from their layout):

Category Filters
1	Default	2	Block All	3	InfoTech Filter	4	Extended Access	5	Internet Filter
Abortion	Block		Block		Permit		Permit		Permit
Abused Drugs	Block		Block		Confirm		Confirm		Confirm
Adult Content	Block		Block		Block		Block		Block
Adult Material	Block		Block		Block		Block		Block
Advertisements	Block		Block		Permit		Permit		Permit
Advocacy Groups	Block		Block		Permit		Permit		Permit
Alcohol and Tobacco	Block		Block		Permit		Permit		Permit
Alternative Journals	Block		Block		Permit		Permit		Permit
Bandwidth	Block		Block		Permit		Permit		Permit

Would any others like to see this type of layout native from their "Export Policies" spreadsheet? If so, send in your enhancement requests, or reply to this post....

import IP address ranges

mlpotgieter — Fri, 11 May 2012 14:52:31 GMT

There is an option to import Users, Computers, and groups from CSV files, however being able to import network ranges will also be useful.

Block iTunes Movie but allow Apple Apps Access

dennis — Wed, 22 Feb 2012 19:38:45 GMT

Is it possible to block access to the iTunes store for Movie and audio downloads but still allow access to the Apple Apps store?

I turned on the block for MP3 and Audio Download filter, but when I did that I also lost access to the Apple Apps store.

Any suggestions?

WES 7.3 hotfix 4 failure

Patrick Chan — Thu, 10 May 2012 08:37:01 GMT

1. Backup Database from WES 7.2

2. Fresh install WES 7.3

3. Restore from WES 7.2 Database backup file

3. Install WES 7.3 HF2 (complete successfully)

4. Install WES 7.3 HF4 (Error message: The current WES database version is not cimpatible with this HF)

What's wrong for my step ? Thanks !

DKIM or SPF Sign

NazZaR — Thu, 10 May 2012 06:01:11 GMT

Hello!

Can you tell me, is WES supporting DKIM or SPF signing of emails?

Thank you!

Password Override option not found

DKuruvila — Sat, 05 May 2012 01:02:12 GMT

Lately we have been getting some errors regarding the Password Override option in Websense 6.3.1. Some of the clients will not be able to see the Password Override option in the blocked pages. Can it be rectified by restarting the service DC agent? Is this the correct way to troubleshoot the issue?

Please share your thought on this.