McAfee 7.8.0 Web Gateway Installation Guide

PDF

Dokument

Installation Guide

McAfee Web Gateway 7.8.0

COPYRIGHT

TRADEMARK ATTRIBUTIONS

McAfee and the McAfee logo, McAfee Active Protection, ePolicy Orchestrator, McAfee ePO, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes,

McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee,

LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others.

LICENSE INFORMATION

License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE

GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE

CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE

RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU

DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF

APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.

2 McAfee Web Gateway 7.8.0

Installation Guide

Deployment of the appliance 5

Setting up Web Gateway 7

High-level steps for setting up Web Gateway . . . . . . . . . . . . . . . . . . . . . . . . . 7

Verify the requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Review the default initial configuration settings . . . . . . . . . . . . . . . . . . . . . . .

Default serial system console settings . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Set up a physical appliance with pre-installed software . . . . . . . . . . . . . . . . . . . .

Set up a physical appliance with downloaded software . . . . . . . . . . . . . . . . . . . . . 11

Download the software for a physical appliance . . . . . . . . . . . . . . . . . . . . 12

Install the downloaded software on a physical appliance . . . . . . . . . . . . . . . . . 12

Set up a virtual appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Download the software for a virtual appliance . . . . . . . . . . . . . . . . . . . . . 13

Install the downloaded software on a virtual appliance . . . . . . . . . . . . . . . . .

Virtual machine settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Setting up a virtual appliance with Hyper-V . . . . . . . . . . . . . . . . . . . . . . . . . 16

High-level steps for setting up a virtual appliance with Hyper-V . . . . . . . . . . . . . .

Setting up Web Gateway in an AWS environment . . . . . . . . . . . . . . . . . . . . . . . 17

Choosing an Amazon instance type . . . . . . . . . . . . . . . . . . . . . . . . . 17

Create a key pair for SSH authentication . . . . . . . . . . . . . . . . . . . . . . . 18

Import a key pair for SSH authentication . . . . . . . . . . . . . . . . . . . . . . . 18

Set up a Web Gateway instance within AWS . . . . . . . . . . . . . . . . . . . . . . 19

Connect to a Web Gateway instance within AWS . . . . . . . . . . . . . . . . . . . . 20

Implement the initial configuration settings . . . . . . . . . . . . . . . . . . . . . . . . . 20

Implement the default initial configuration settings . . . . . . . . . . . . . . . . . . . 21

Implement your own initial configuration settings . . . . . . . . . . . . . . . . . . . 21

Log on to the user interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Work with the setup wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Activate the product . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Configure more initial settings . . . . . . . . . . . . . . . . . . . . . . . . . .

Solve problems with connecting to the download servers . . . . . . . . . . . . . . . . . 25

Activate Web Gateway with a temporary license key . . . . . . . . . . . . . . . . . . . . . . 26

Re-image an appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Upgrading Web Gateway offline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Upgrade offline with the mwg-update tool . . . . . . . . . . . . . . . . . . . . . . 27 mwg-update command line tool . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Supported blade servers and enclosures 29

Installing the blade server system 31

Preparing the installation of the blade server system . . . . . . . . . . . . . . . . . . . . .

Install the blade server system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Install the blade system enclosure . . . . . . . . . . . . . . . . . . . . . . . . . 32

Install the interconnect modules . . . . . . . . . . . . . . . . . . . . . . . . .

Turn on the blade system enclosure . . . . . . . . . . . . . . . . . . . . . . . . 33

McAfee Web Gateway 7.8.0

Installation Guide 3

Contents

Install Web Gateway on a blade server 35

Use the internal CD/DVD drive to install Web Gateway on a blade server . . . . . . . . . . . . . . 36

Use an external CD/DVD drive to install Web Gateway on a blade server . . . . . . . . . . . . . . 36

Use a USB drive to install Web Gateway on a blade server . . . . . . . . . . . . . . . . . . .

Use virtual media to install Web Gateway on a blade server . . . . . . . . . . . . . . . . . . . 37

Network setup for Web Gateway on a blade server 39

Proxy HA on a blade server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Proxy with external load balancing on a blade server . . . . . . . . . . . . . . . . . . . . .

Transparent modes on a blade server . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Index 43

4 McAfee Web Gateway 7.8.0

Installation Guide

Deployment of the appliance

Before you set up the McAfee Web Gateway appliance, consider how you want to use it. You can run it on different platforms and configure different modes of network integration. You can also set up and administer multiple appliances as nodes in a Central Management configuration.

Platform

You can run the appliance on different platforms.

• Hardware-based appliance — On a physical hardware platform

• Virtual appliance — On a virtual machine

Network integration

In your network, the appliance can intercept, filter, and transmit web traffic in different modes.

• Explicit proxy mode — The clients that the appliance communicates with are aware of it. You must configure them “explicitly” to direct their traffic to the appliance.

• Transparent modes — The clients are not aware of the appliance.

• Transparent bridge — The appliance acts as an “invisible” bridge between its clients and the web. You need not configure the clients for this.

• Transparent router — The appliance routes traffic according to a routing table, which you need to fill out.

Administration and updates

You can administer the appliance and have updates distributed in different ways.

• Standalone — Administer the appliance separately and let it not receive updates from other appliances.

• Central Management — Set up the appliance as a node in a complex configuration and administer other nodes on its user interface, including the distribution of updates.

You can then administer the appliance on other nodes and let it receive updates from them.

McAfee Web Gateway 7.8.0

Installation Guide 5

1 Deployment of the appliance

6 McAfee Web Gateway 7.8.0

Installation Guide

Setting up Web Gateway

To set up Web Gateway, you need to complete several activities, such as checking your installation materials, configuring initial settings, and logging on to the user interface.

The setup procedure differs according to the platform that you install the appliance software on and the way the software is provided.

When the installation is completed and you log on to the user interface for the first time, you also need to import a license and activate the product.

Contents

High-level steps for setting up Web Gateway

Verify the requirements

Review the default initial configuration settings

Default serial system console settings

Set up a physical appliance with pre-installed software

Set up a physical appliance with downloaded software

Set up a virtual appliance

Setting up a virtual appliance with Hyper-V

Setting up Web Gateway in an AWS environment

Implement the initial configuration settings

Log on to the user interface

Work with the setup wizard

Activate Web Gateway with a temporary license key

Re-image an appliance

Upgrading Web Gateway offline

High-level steps for setting up Web Gateway

To set up a Web Gateway appliance, complete the following high-level steps.

Task

1 Verify the requirements for the setup.

2 Review the default initial configuration settings.

McAfee Web Gateway 7.8.0

Installation Guide 7

2 Setting up Web Gateway

High-level steps for setting up Web Gateway

3 Install the appliance software.

• When setting up Web Gateway as a physical appliance with pre-installed software, connect and turn on the appliance.

• When setting up Web Gateway as a physical appliance with downloaded software:

• Download the software and copy it to some installation media.

• Connect the appliance, insert the installation media, and turn on the appliance.

• Work with the Boot Manager to install the software.

• When setting up Web Gateway as a virtual appliance:

• Download the software and copy it to some installation media.

• Insert the installation media into a suitable host system.

• Create a virtual machine on the host system.

• Start the new virtual machine.

4 Implement the initial configuration settings.

5 Log on to the user interface.

6 Review online documents and import a license.

7 Activate the product.

When you have completed the setup, you can work with the user interface of Web Gateway to perform more administrator activities.

After having set up Web Gateway once in a first installation, you can upgrade to new product versions when they are released.

For information about how to upgrade, see the release notes that are provided with each new product version.

If the first version of Web Gateway that you installed is older than 7.7.2, a certificate for use in a

Central Management cluster of appliances, known as cluster CA, is provided with this version.

We strongly recommend that you replace this default certificate with a certificate of your own as soon as possible to ensure web security.

For more information, see Import a certificate and private key for a cluster CA in this document.

8 McAfee Web Gateway 7.8.0

Installation Guide

Setting up Web Gateway

Verify the requirements

Before you set up Web Gateway as a physical or virtual appliance, make sure that you have available what is needed.

Requirements for setting up a physical appliance

To set up a physical appliance, the following is required:

• Items that were shipped to you:

• Hardware platform (models vary) with appliance software

The recommended minimum memory size on a hardware platform is 8 GB. If you are using an older model with less than this size, you can upgrade. See Memory upgrade.

• Power cord

• Network cables

• USB-PS/2 adapter cable (if you use a PS/2 keyboard for the initial configuration)

Installation media (CD/DVD and USB drive) with the appliance software were also shipped to you. They are not required for the setup, but you can use them for re-imaging the appliance.

• Items that you must provide:

• Standard VGA monitor and PS/2 keyboard

or serial system console

• Administration system with:

• Windows or Linux operating system

• Oracle Java Runtime Environment (JRE), version 1.7, also referred to as Java 7, or later

JRE is required for running the user interface.

Web Gateway 7.5.1 is the last major version to support JRE 1.6 (Java 6). Beginning with version 7.5.2, Web Gateway requires JRE 1.7 or 1.8 (Java 7 or 8).

The current product version, 7.7.2, requires JRE 1.8 (Java 8).

• Microsoft Internet Explorer, version 6.0 or later

or Mozilla Firefox, version 2.0 or later

• Network cables for the administration system

Requirements for setting up a virtual appliance

To set up a virtual appliance, the following is required:

• One of the following VMware types:

• VMware ESX

• VMware ESXi

The following table shows the versions of the two VMware types that are recommended for use with particular versions of Web Gateway. VMware versions that are not recommended can still be run, however, with Web Gateway.

McAfee Web Gateway 7.8.0

Installation Guide 9

2 Setting up Web Gateway

Review the default initial configuration settings

Table 2-1 Recommended VMware versions

ESX/ESXi 4.1

ESX/ESXi 5.0

ESX/ESXi 5.5

update 2

MWG

7.4.x

MWG

7.5.x

MWG

7.6.x

MWG

7.7.x

MWG

7.8.x

Not recommended

Recommended Recommended Not

Not recommended

ESX/ESXi 6.0

Recommended Not recommended recommended

Recommended Not

Not recommended

ESX/ESXi 6.0

update 2

Not recommended

Recommended Recommended Not recommended

Not recommended recommended

ESX/ESXi 6.5

Not recommended

Recommended Not recommended

Recommended Recommended

• Virtual machine host system with the following specifications:

• CPU — 64-bit capable

• Virtualization extension — VT-x/AMD-V

• Virtual machine with the specifications shown in the following table.

Specifications differ depending on what you are using a virtual appliance for.

Table 2-2 Specifications for a virtual machine

Use

Functional testing (one user) or Central

Management console (no traffic)

Production (minimum)

Production (recommended)

Memory (RAM in GB) Hard disk space (in GB) CPU cores

4 80 2

200

500

4 at least 4

Review the default initial configuration settings

You can set up an appliance with default initial configuration settings or implement your own settings, using the configuration wizard that appears during the process.

The following table shows the default settings.

Table 2-3 Default initial configuration settings

Parameter

Primary network interface

Autoconfiguration with DHCP

Host name

Root password

Remote root logon with SSH

Default gateway

DNS server

Value eth0 yes mwgappl webgateway on

10 McAfee Web Gateway 7.8.0

Installation Guide

Setting up Web Gateway

Default serial system console settings

When connecting a serial system console to a Web Gateway appliance for administration purposes, the default settings are as follows.

Table 2-4 Default serial console settings

Parameter

Baud rate

Data bits

Parity bit

Stop bits

Short

Flow control

Value

19200

N (no)

19200/8-N-1 no

Set up a physical appliance with pre-installed software

On a newly purchased hardware platform, the appliance software is pre-installed. Connect the appliance and turn it on.

Task

1 Connect the appliance to power and the network.

2 Connect a monitor and keyboard or a serial system console to the appliance.

3 Turn on the appliance.

The configuration wizard appears.

4 Work with the configuration wizard to implement the initial configuration settings.

After implementing the initial configuration settings, you can log on to the user interface and activate the Web

Gateway appliance.

When the appliance is activated, you can perform other activities on the user interface.

We strongly recommend updating the appliance software under Configuration | Appliances.

When this update is performed, the appliance software is upgraded to the latest maintenance version of the major version that is pre-installed. For example, if version 7.7.0.2 is pre-installed, which belongs to major version 7.7.0, and the latest maintenance version within this range is 7.7.0.3, the software on your Web Gateway appliance is upgraded to this version.

A maintenance version, such as 7.7.0.3, includes the latest enhancements if there are any and resolves issues that occurred in earlier versions.

Set up a physical appliance with downloaded software

When setting up a physical appliance, you can install software that you downloaded from the McAfee Content &

Cloud Security Portal.

McAfee Web Gateway 7.8.0

Installation Guide 11

Setting up Web Gateway

Set up a physical appliance with downloaded software

Tasks

•

Download the software for a physical appliance on page 12

You can download different versions of the appliance software in ISO or USB format.

•

Install the downloaded software on a physical appliance on page 12

To install the downloaded software on a physical appliance, connect the appliance, turn it on, and work with the Boot Manager.

Download the software for a physical appliance

You can download different versions of the appliance software in ISO or USB format.

Task

1 Use a browser to go to the McAfee Content & Cloud Security Portal at https://contentsecurity.mcafee.com/

2 Submit your user name and password.

3 Beginning on the home page of the portal, select Software | McAfee Web Gateway 7 | Download.

A page with software versions in ISO and USB format appears.

4 Click the icon for the exact software version you want to download.

A download window opens.

5 Select the option for storing a file and click OK.

The software is downloaded and stored within your file system.

6 Copy the downloaded software to a CD/DVD or a USB drive to have it available for installation.

Install the downloaded software on a physical appliance

To install the downloaded software on a physical appliance, connect the appliance, turn it on, and work with the

Boot Manager.

Task

1 Connect the appliance to power and the network.

2 Connect a monitor and keyboard or a serial system console to the appliance.

3 Insert the CD/DVD or the USB drive with the downloaded software.

4 Turn on the appliance.

The installation begins.

5 During the initial phase, select the installation device:

• If your appliance hardware model is Web Gateway (WBG) 4500B, 5000B, or 5500B:

• Press F6 to enter the Boot Manager.

• Select the drive for the CD/DVD or USB format, then press Enter.

• If your model is Web Gateway (WBG) 4000B:

• Press F2 to enter the BIOS setup menu.

• Select Boot Options and click Hard Disk Order.

McAfee Web Gateway 7.8.0

Installation Guide

Setting up Web Gateway

Set up a virtual appliance

• Select the option that assigns the CD/DVD or USB drive the highest priority.

• Click the Exit tab.

• Select Discard Changes.

Do not use the Discard Changes and Exit option here.

• Select Boot Manager and select the drive for the CD/DVD or USB format. Then press Enter.

• If your model is not specified:

• Press F11 to enter the Boot Manager.

• Select the drive for the CD/DVD or USB format, then press Enter.

The installation menu appears on the monitor.

6 Select an installation mode, then press Enter.

Help text is displayed for a selected mode below the menu.

The downloaded software is installed on the appliance. When this installation is completed, the configuration wizard appears.

You can now work with the configuration wizard to implement the initial configuration settings.

Set up a virtual appliance

To set up a virtual appliance, download the appliance software from the McAfee Content & Cloud Security Portal and install it on a virtual machine.

You can create the virtual machine that is required for setting up a virtual appliance using the Hyper-V role of a

Microsoft Windows server.

Tasks

•

Download the software for a virtual appliance on page 13

You can download different versions of the appliance software in ISO format.

•

Install the downloaded software on a virtual appliance on page 14

To install the downloaded software on a virtual appliance, insert the CD/DVD with the software in a suitable host system, create a virtual machine on this system, and start the virtual machine.

Download the software for a virtual appliance

You can download different versions of the appliance software in ISO format.

Task

1 Use a browser to go to the McAfee Content & Cloud Security Portal at https://contentsecurity.mcafee.com/ .

2 Submit your user name and password.

3 Beginning on the home page of the portal, select Software | McAfee Web Gateway 7 | Download.

A page with software versions in ISO and USB format appears.

4 Click the ISO icon for the exact software version you want to download.

A download window opens.

McAfee Web Gateway 7.8.0

Installation Guide 13

2 Setting up Web Gateway

Set up a virtual appliance

5 Select the option for storing a file and click OK.

The software is downloaded and stored within your file system.

6 Copy the downloaded software to a CD/DVD to have it available for installation.

Install the downloaded software on a virtual appliance

To install the downloaded software on a virtual appliance, insert the CD/DVD with the software in a suitable host system, create a virtual machine on this system, and start the virtual machine.

Task

1 Connect a keyboard and monitor to a suitable host system.

2 Insert the CD/DVD with the appliance software.

3 Using your VMware, create a virtual machine on the host system.

4 Start the new virtual machine.

The appliance software is installed on the virtual machine. When this installation is completed, the configuration wizard appears on the monitor of the host system.

You can now work with the configuration wizard to implement the initial configuration settings.

If your VMware type is ESXi and you are running a Vsphere client, you can use the following methods to make the appliance software available on the host system:

• Insert a CD/DVD with the appliance software into the host system (as was already described)

• Store the appliance software on a local disk or the datastore of the host system

• Store the appliance software on a USB drive and insert it into the host system

Virtual machine settings

When setting up a virtual appliance, you need to configure settings for the virtual machine you want to use as the platform for the appliance software.

The procedures for setting up a virtual machine differ for each VMware type. Make sure that you configure the settings listed in the following table.

For parameters that are not listed, use the default values given in the procedures. Parameter names can also differ with each procedure.

Table 2-5 Virtual machine settings

Option

Configuration type

Installation mode

Operating system

Definition

Typical | Advanced (recommended)

Install from disk | ISO image (required) | Install later

Linux 64 bit, version 2.6

14 McAfee Web Gateway 7.8.0

Installation Guide

Setting up Web Gateway

Set up a virtual appliance

Table 2-5 Virtual machine settings (continued)

Option

Memory

Definition

32 GB (recommended, for more information, see Verify the requirements)

Starting with version 4.1, VMware ESXi, which is one of the supported

VMware types for a virtual Web Gateway appliance, includes some optimizations known as NUMA optimizations.

A host system for virtual machines that runs this VMware is also referred to as a NUMA node. Memory must then be allotted to a virtual machine in relation to the memory that is available on a NUMA node, otherwise you might experience a severe impact on performance.

For example, if you set up three virtual machines on one NUMA node and configure the same number of processors (also known as CPU cores) for each virtual machine, you should not allot more than one third of the memory that is available on the NUMA node to each virtual machine.

Best results are achieved, however, if you run one virtual machine on one

NUMA node.

Make sure that you also reserve a certain amount of memory for the NUMA node (the host system).

Hard-disk space 500 GB (recommended, for more information, see Verify the requirements)

Number of processors 1 | 2 | 4 (recommended, for more information, see Verify the requirements) | ...

The number of processors (also known as CPU cores) that are provided for selection depends on the equipment of the host system that is used for setting up the virtual appliance.

When virtual machines are set up on a host system that runs ESXi VMware, version 4.1 or later, with NUMA optimizations, see also under Memory, CPU cores should be configured in relation to what is allowed on a NUMA node (a host system).

The number of CPU cores that you configure for a virtual machine should be multiples or divisors of the number of CPU cores that fit in with the size of a NUMA node.

For example, if the size of a NUMA node is sufficient for running six CPU cores, you should configure virtual machines with two, three, or six cores (if you are only using one node), or with 12, 18, 24, and so on (if you are using multiple nodes).

Best results are achieved, however, if you run one virtual machine on one

NUMA node.

Network connection mode

CD/DVD drive with assigned ISO image

Network interface card type

SCSI controller (for some ESX versions)

Bridged (recommended) | NAT | ...

E1000 | VMXNET 3 (recommended)

BusLogic SCSI (not supported in a 64-bit environment) | LSI Logic Parallel (default) |

LSI Logic SAS | VMware PV SCSI (recommended)

McAfee Web Gateway 7.8.0

Installation Guide 15

2 Setting up Web Gateway

Setting up a virtual appliance with Hyper-V

You can set up a virtual machine with Hyper-V and use it as a platform for running the Web Gateway appliance software.

Hyper-V is a role in several Microsoft Windows Server products that provides the tools and services to create virtualized servers. You can use these servers as the virtual machines that are required for running Web

Gateway as a virtual appliance.

Multiple virtual appliances can be set up this way on one hardware system, allowing you to work with multiple separate operating systems.

Supported platforms

The following Hyper-V server products are supported as platforms for running a virtual Web Gateway appliance.

• Windows Server 2012 R2 (64-bit)

• Microsoft Hyper-V Server 2012 R2 (64-bit)

• Windows Server 2008 R2 (64-bit)

System requirements

Ensure that the following requirements are met on the hardware system you are using when setting up a virtual

Web Gateway appliance with Hyper-V.

Table 2-6 System requirements for running a virtual appliance

Use

Functional testing (one user) or Central

Management console (no traffic)

Production (minimum)

Production (recommended)

Memory (RAM in GB) Hard disk space (in GB) CPU cores

4 80 2

200

500

4 at least 4

Static MAC address

A virtual machine on a Hyper-V server platform is by default configured to use dynamic MAC addresses. When

Web Gateway runs as a virtual appliance on this platform, using dynamic MAC addresses results in losing IP address information after a restart.

For this reason, the default settings must be changed to let the virtual appliance use a static MAC address.

High-level steps for setting up a virtual appliance with Hyper-V

To set up a virtual appliance using the Hyper-V server role, complete the following high-level steps.

Task

1 Install a suitable Microsoft Windows server product on the system that you want to run Web Gateway on.

2 Set up Hyper-V as a server role.

3 Complete the following using the Hyper-V manager.

a Set up Web Gateway as a virtual appliance.

When configuring the virtual appliance settings, make sure that dynamic memory is disabled, as this feature is not supported on Web Gateway.

16 McAfee Web Gateway 7.8.0

Installation Guide

Setting up Web Gateway

Setting up Web Gateway in an AWS environment

2 b Create a virtual network for the appliance.

4 Configure a static MAC address for the virtual appliance.

For more detailed information about how to complete these high-level steps. see the Microsoft Windows documentation on Hyper-V and this Knowledge Center article: KB85837 .

Setting up Web Gateway in an AWS environment

Web Gateway can be set up and run in an Amazon Web Services (AWS) environment.

This mode of operation allows you to use the features of the product without having to set up and maintain any appliances.

When setting up Web Gateway in this way, be sure to have the following available during the setup process.

• AMI ID — ID for an instance of Web Gateway that you want to set up in an AWS environment

This ID is displayed on the AWS console that is used for the setup when the instance is ready for launching.

By comparing the displayed number with the number in a list, you can verify that this is indeed the instance that you want to launch.

• Region — Region where you want run an instance

The instance ID changes for an instance when it is run in different regions. The mapping of IDs to regions can also be looked up in a list.

• AWS account number — Number of the Amazon Web Services account that is owned by McAfee

The account number is also displayed on the AWS console when an instance is ready for launching.

For the list of valid AMI IDs and regions, as well as for the account number, see the download section of the

McAfee Content & Cloud Security Portal at https://contentsecurity.mcafee.com/software_mwg7_download .

The setup process includes the following high-level steps.

1 Choose an Amazon instance type based on the amount of web traffic that will pass through Web Gateway according to your planning.

2 Create or import a pair of SSH keys, which are required for authentication when you access an instance of

Web Gateway within AWS.

3 Set up an instance of Web Gateway within AWS.

4 Connect to the Web Gateway instance and log on to the user interface.

After logging on to the user interface, you can work with the web security features that are provided by Web

Gateway.

Choosing an Amazon instance type

Before setting up Web Gateway within AWS, you must choose an Amazon instance type for this setup.

For Web Gateway, only Amazon instance types belonging to the HVM type group are supported.

Which instance type you choose depends on what you plan to use the Web Gateway instance for, for example, testing or production.

You should also take into account network performance and the number of NICs that you plan to run with the instance.

McAfee Web Gateway 7.8.0

Installation Guide 17

2 Setting up Web Gateway

Setting up Web Gateway in an AWS environment

The following table shows some common use cases and Amazon instance types that you can choose.

Table 2-7 Use cases and Amazon instance types

Use Memory (RAM in

GB)

Functional testing (one user) 4

Production (minimum) 16

Production (recommended) 32 or more

Hard disk space (in

GB)

80 or more

CPU cores Instance type

(examples) m4.large

4 or more m4.xlarge

4 or more m4.2xlarge

Create a key pair for SSH authentication

To access Web Gateway within AWS, you must provide an SSH key pair for authentication. You can create this key pair on an AWS Web Console.

Task

1 On the AWS Web Console, select the region where you want to set up Web Gateway from the drop-down menu in the upper right corner.

2 Navigate to the Services menu in the upper left corner and select EC2.

3 Select Network and Security, then Key Pairs.

4 Click Create Key Pair.

5 Type a key pair name and enter it.

A key pair file is generated and downloaded to the system that the AWS Web Console is connected to.

The key pair file is generated with a .pem ending.

To connect to Web Gateway instance within AWS using PuTTY, convert the .pem file into the .pkk format, which is supported by PuTTY.

Import a key pair for SSH authentication

When connecting to Web Gateway within AWS, you must provide an SSH key pair for authentication. You can import this key pair using an AWS Web Console.

Task

1 On the AWS Web Console, navigate to the Services menu in the upper left cornerm and select EC2.

2 Select Network and Security, then Key Pairs.

3 Click Import Key Pair, then browse to a key pair and select it.

A file with the selected key pair is downloaded to the system that the AWS Web Console is connected to.

18 McAfee Web Gateway 7.8.0

Installation Guide

Setting up Web Gateway

Setting up Web Gateway in an AWS environment

Set up a Web Gateway instance within AWS

To set up an instance of Web Gateway within AWS, complete the following procedure using an AWS Web

Console.

Task

1 On the AWS Web Console, navigate to the Services menu in the upper left corner, then select EC2.

2 Launch a Web Gateway image.

a Select Images, then click AMIs.

b In the search field that appears, type and submit mwg.

c Select a Web Gateway image file and click Launch.

3 Select and configure an instance type for Web Gateway.

a Select an instance type based on your considerations regarding the use of the instance.

b Click Next: Configure Instance Details and in the Network list that appears make sure that the default VPC

(Virtual Private Cloud) is selected.

The instance is set up in a Virtual Private Cloud. Every AWS account created after December 4, 2013, has a default VPC ready to use within each AWS region.

c Click Next: Add Storage and increase the size of the hard disk drive to at least 80 GB.

d (Optional) Click Next: Add Tags and add a key-value pair to tag the instance.

This step is not required, but enables you to categorize instances, for example, by owner or purpose.

4 Configure a security group for Web Gateway.

a Click Next: Configure Security Group.

b Change the default name of the security group, for example, to MWG-security-group.

c Configure rules for the security group, for example, as follows.

Table 2-8 Rules for a security group

Type

SSH rule

Customized TCP rule

Protocol

TCP

Port

Source my IP

9090 my IP

4712 my IP

These rules ensure that the configured ports on Web Gateway cannot be accessed by anyone other than yourself.

For testing and production, change access to the ports according to your considerations. For a complete list of ports used by Web Gateway, see this Knowledge Center article: KB86010 .

5 Launch the Web Gateway instance.

a Click Review and Launch.

Use

SSH access

Proxy port

Admin user interface HTTPS b Review what you have configured and make changes if necessary, then click Launch.

When reviewing the configuration, make sure that the AMI ID of your instance and the AWS account number are also correct.

McAfee Web Gateway 7.8.0

Installation Guide 19

2 Setting up Web Gateway

Implement the initial configuration settings c Select the SSH key pair that you created, then click Launch Instances.

The instance begins to launch.

d Click View Instances to monitor the launch status.

When the status in the Status Checks column changes to 2/2 checks passed, the instance is ready to use.

You can now connect to the instance and log on to its user interface.

Connect to a Web Gateway instance within AWS

To connect to an instance of Web Gateway within AWS, complete the following procedure using an AWS web console.

Task

1 On the AWS Web Console, navigate to the Services menu in the upper right corner, then select EC2.

2 Select Instances and right-click the name of the Web Gateway instance.

3 Select Connect and execute the commands for connecting to the instance described in the window that opens.

When performing the SSH authentication command, be sure not to use root, as it reads in the description, but the ec2 user name, which also includes the domain, for example ssh -i <key pair file name> [email protected]

4 Next to the command line prompt that appears after you have successfully authenticated, type ec2-user and submit.

A password is shown, which is the one that is required for logging on to the user interface of Web Gateway.

5 Log on to the user interface of Web Gateway.

a In a web browser, enter the appropriate URL.

This URL must include the Amazon public DNS name of the Web Gateway instance, for example: https://foo.eu-west-2.compute.amazonaws.com:4712 b When prompted for your credentials, submit admin as the user name and the password that was shown before, see step 4.

After logging on to the user interface successfully, you can work with the web security features that are provided by Web Gateway.

Implement the initial configuration settings

Work with the configuration wizard to implement the default or your own initial configuration settings on an appliance.

Tasks

•

Implement the default initial configuration settings on page 21

To implement the default initial configuration settings, work with the wizard to configure a root password and remote root logon, but leave the remaining settings unchanged.

•

Implement your own initial configuration settings on page 21

To implement your own initial configuration settings, follow the instructions of the wizard.

20 McAfee Web Gateway 7.8.0

Installation Guide

Setting up Web Gateway

Implement the initial configuration settings

Implement the default initial configuration settings

To implement the default initial configuration settings, work with the wizard to configure a root password and remote root logon, but leave the remaining settings unchanged.

Task

1 Press Esc in response to all prompts of the configuration wizard until the root password is configured.

2 When asked for the root password, enter and repeat it, then confirm it with OK.

3 When asked to allow remote root logon with SSH, click Yes or No.

When the initial configuration settings are implemented, the appliance restarts and the appliance volume wizard appears to let you resize the volume of the web cache.

For more information, refer to the System configuration chapter of the McAfee Web Gateway Product Guide.

After completing the initial configuration, with or without resizing the web cache, you can log on to the user interface.

Implement your own initial configuration settings

To implement your own initial configuration settings, follow the instructions of the wizard.

Task

1 In the wizard windows, configure the following:

• Primary network interface

• IP address, entered manually or configured dynamically by DHCP

If you plan to configure the explicit proxy mode with High Availability functions (Proxy HA) mode later on, we strongly recommend not to enter a virtual IP address here.

• Network mask (only after entering the IP address manually)

• Default gateway (only after entering the IP address manually)

• Host name

• DNS server (only after entering the IP address manually)

2 Review the summary that is displayed after configuring the first settings.

• If you approve of the summary, confirm and configure the remaining settings:

• Root password

• Remote root logon with SSH

The installation is completed with your initial configuration settings and the IP address is displayed.

You can now log on to the user interface.

• If you need to make changes, click Cancel and return to step 1.

When the initial configuration settings are implemented, the appliance restarts and the appliance volume wizard appears to let you resize the volume of the web cache.

For more information, refer to the System configuration chapter of the McAfee Web Gateway Product Guide.

After completing the initial configuration, with or without resizing the web cache, you can log on to the user interface.

McAfee Web Gateway 7.8.0

Installation Guide 21

2 Setting up Web Gateway

Log on to the user interface

To log on to the Web Gateway user interface, use a browser on your administration system.

Some browsers do or (will soon) not support logging on to and running the Web Gateway interface anymore due to its plug-in architecture, for example, Google Chrome and Mozilla Firefox.

When working with one of these browsers, you can still open the logon window and download a Web

Start application to run the user interface without a browser.

Task

1 Open the browser and go to one of the following:

• http://<IP address>:4711

• https://<IP address>:4712

<IP address> is the IP address from the initial configuration.

Under HTTPS, accept the self-signed certificate that appears.

The logon window opens.

2 Proceed in one of the following ways.

• If your browser supports logging on to and running the user interface:

Enter admin as the user name and webgateway as the password, then click Login.

After a successful logon, the setup wizard appears.

When you've completed the wizard activities, the user interface appears and you can start working with

Web Gateway.

• If your browser does not support logging on to and running the user interface:

1 Click Download MWG-UI Webstart.

The Web Start application is downloaded, which in turn downloads the user interface and stores it locally. When the download has completed, another logon window opens.

An icon is added to the desktop of your system for subsequent logons.

2 [Optional] Work with the Advanced options to configure an IP address and port for Web Gateway, as well as the use of an SSL-secured connection.

The default port number when using SSL is 4712, otherwise it is 4711.

If you change these settings when working with the user interface later on, you must change them here as well.

You can configure even more settings after clicking System Preferences.

3 In the logon window, enter admin as the user name and webgateway as the password, then click

After a successful logon, the setup wizard appears.

22 McAfee Web Gateway 7.8.0

Installation Guide

Setting up Web Gateway

Work with the setup wizard

When you've completed the wizard activities, the user interface appears and you can start working with

Web Gateway.

Work with the setup wizard

Work with the setup wizard to activate the product and complete the setup procedure.

Tasks

•

Activate the product on page 23

To activate the product, review two online documents on licensing and data usage, then import a license and click the activation button.

•

Configure more initial settings on page 24

Configure initial settings for the time zone, network interfaces, and DNS servers.

•

Solve problems with connecting to the download servers on page 25

Complete this procedure if the download that is started after activating the product fails due to problems with connecting to the download servers.

Activate the product

To activate the product, review two online documents on licensing and data usage, then import a license and click the activation button.

You must agree to the content of the online documents if you want to activate the product.

For the licensing procedure, a file with a license key was sent to you. If you have not received it, contact McAfee support. In the meantime, you can use a temporary key.

Task

1 In the License section of the setup wizard, click End User License Agreement and review the agreement. If you agree to it, select the corresponding checkbox.

2 Click Data Usage Statement and review the statement. If you agree to it, select the corresponding checkbox.

3 Click Browse and use the file manager that opens to select the file with the license key, then click OK.

The Activate product button becomes accessible.

4 Click Activate product.

Web Gateway is activated and an initial download of files begins to update the information used by the anti-malware and URL filtering modules (engines).

Download progress is indicated by a progress bar at the bottom and explained by a status label.

McAfee Web Gateway 7.8.0

Installation Guide 23

2 Setting up Web Gateway

Work with the setup wizard

5 Do one of the following:

• Wait until the download finishes successfully, then click Close wizard.

This completes the setup procedure. You can now work with the user interface to perform more administration activities.

If you want to configure settings for data collection, configure them and click Save Changes when you are done. For more information, refer to the Data Usage Statement.

Be sure not to click Save Changes to save any other settings before configuring data collection (if you want to do it at all), as data collection starts when this button is clicked for the first time.

For more information on how to work with the user interface, refer to the McAfee Web Gateway Product

Guide.

• Configure more initial settings.

The download progress remains visible while you continue with the wizard.

If the download fails, an error message appears and the Network solutions section becomes accessible in the navigation area. This section allows you to solve problems with connecting to the download servers.

Configure more initial settings

Configure initial settings for the time zone, network interfaces, and DNS servers.

You can configure these settings later, working with the user interface. From the Configuration top-level menu, select Date and Time, Network Interfaces, or Domain Name Service.

To set administrator passwords, select Accounts | Administrator Accounts.

Task

1 In the Time zone section of the wizard, select a time zone for the Web Gateway appliance or leave the default zone (UTC).

2 On the Network interfaces tab of the Network settings section, configure the following:

• In the Host name / Fully qualified domain name field, type a host name for the appliance.

• In the Default gateway (IPv4) or Default gateway (IPv6) fields, type an IP address in IPv4 or IPv6 format.

To configure the default gateway address dynamically, select Obtain automatically (DHCP) under IP settings.

We recommend that you do not configure more than one DHCP interface, as proper operation is not ensured otherwise.

If you set up Web Gateway in an AWS environment, we recommend configuring the first

(default) network interface using DHCP. This will reduce the risk of losing access to the respective AWS instance.

3 On the Domain name servers tab of the Network settings section, type IP addresses for up to three DNS servers.

4 [Optional] In the Password section, change the preconfigured administrator password.

24 McAfee Web Gateway 7.8.0

Installation Guide

Setting up Web Gateway

Work with the setup wizard

5 Click Close wizard.

The wizard closes and the user interface becomes accessible. A message asks if you want to save the configuration.

6 Do one of the following:

• If you also want to configure settings for data collection, configure them and click Save Changes when you are done. For more information, refer to the Data Usage Statement.

• Click Save Changes now.

Solve problems with connecting to the download servers

Complete this procedure if the download that is started after activating the product fails due to problems with connecting to the download servers.

Task

1 In the Network solutions section of the wizard, do one of the following, depending on the problem.

• If the download servers cannot be used for updating filtering information because you are running the appliance in an environment without internet connection, click Perform offline update and follow the wizard instructions.

• If you want to use a next-hop proxy to connect to the download servers, click Specify next-hop proxy for download and continue with step 2.

• If you want to modify the domain name service configuration before connecting to the download servers, click Specify DNS servers for download and continue with step 3.

2 Under Next Hop Proxy Definition, configure the following: a In the Host field, type a host name or an IP address for the next-hop proxy in IPv4 or IPv6 format.

b In the Port field, type a port number for the port on the next-hop proxy that listens to requests from Web

Gateway.

c In the User field, type the user name Web Gateway submits when authenticating to the next-hop proxy.

d In the Password field, type the password Web Gateway submits when authenticating to the next-hop proxy.

e Click Continue.

The wizard closes the Network solutions section and returns to its main page. If you also want to modify the domain name service configuration, continue with step 3, otherwise continue with step 4.

3 Under Domain Name Server Configuration, configure the following: a In the Domain name server fields, type IP addresses for up to three DNS servers.

b Click Continue.

The wizard closes the Network solutions section and returns to its main page.

4 Click Retry download of engines and patterns.

The download completes. If the download still does not complete successfully, close the wizard and try to solve the problem otherwise.

McAfee Web Gateway 7.8.0

Installation Guide 25

2 Setting up Web Gateway

Activate Web Gateway with a temporary license key

If you have not yet received a file with a license key from McAfee, you can use a temporary key to activate Web

Gateway.

To generate this key, use the activation ID that can be found on a label on your appliance box, for example,

Activation ID: 0923839534

Task

1 Use a browser to go to the McAfee Content & Cloud Security Portal at https://contentsecurity.mcafee.com/ .

2 Submit your user name and password.

3 On the home page of the portal, type activate after the URL mentioned in step 1 and press Enter.

The Activation page appears.

4 In the Activation ID field, type the activation ID from the label on your appliance box, then click Activate.

5 Follow the online instructions that are provided.

Re-image an appliance

To re-image an appliance, use the appliance software on the CD/DVD or USB drive that is shipped with it.

Instead of using the appliance software on the shipped media for re-imaging, you can download the software for re-imaging from the McAfee Content & Cloud Security Portal and copy it to a USB drive for re-imaging.

The USB drive must be bootable if to be used for re-imaging. You can create a bootable USB drive with a suitable program, for example, Microsoft Win32diskimager.

Re-imaging an appliance overwrites all data that has previously been stored on it.

Task

1 Back up your appliance configuration on the user interface of Web Gateway, using the functions provided under Troubleshooting | Backup/Restore.

2 Connect a monitor and keyboard to the appliance.

3 Insert the CD/DVD or the USB drive in the appliance.

4 Turn on the appliance.

5 When prompted, press F2 to enter the setup menu.

6 Select Boot manager and then the option for CD/DVD or the USB drive. Then press Enter.

On some appliance models, you can press F6 to enter the boot manager menu directly.

The installation menu appears on the monitor.

7 Select an installation mode, then press Enter.

Help text is displayed for a selected mode below the menu.

The downloaded software is installed on the appliance. When this installation is completed, the configuration wizard appears.

You can now work with the configuration wizard to implement the initial configuration settings.

26 McAfee Web Gateway 7.8.0

Installation Guide

Setting up Web Gateway

Upgrading Web Gateway offline

You can perform an offline upgrade of Web Gateway using an ISO file with the appliance software.

The mwg-update tool is provided for performing the upgrade.

Upgrade offline with the mwg-update tool

Perform an offline upgrade with the mwg-update tool specifying a suitable ISO file.

Task

1 Log on to the appliance you want to perform the upgrade on. You can log on from a local system console or remotely using SSH.

2 Run one of the following commands according to how you want to perform the upgrade.

• mwg-update -o <file name>

As file name type the name of the ISO file with the appliance software, for example,

mwgappl-7.7.1-22595.x86_64.iso.

Run with these parameters, the command allows you to cancel the upgrade before it is actually performed, see the following output lines.

Preparing files ...

Creating repository

Ready to update the current version mwg-7.7.1-22595.mlos2.mwg.x86_64 using the file mwgappl-7.7.1-22595.x86_64.iso

Do you want to proceed? ([y]es/[n]o)

• mwg-update -y -o <file name>

Runs without user interaction, which is useful for scripting.

• mwg-update -d -y -o <file name>

Runs without user interaction, returning debugging information.

mwg-update command line tool

You can use the mwg-update tool to perform an upgrade to a new version of Web Gateway on the command line of a system console.

The command name is: mwg-update

The following table explains the command parameters.

Table 2-9 Parameters of the mwg-update tool

Parameter Definition

No parameter The upgrade is performed using a repository, which must have been enabled.

A repository and path name could, for example, be the following:

/etc/yum.repos.d/mwg.local.repo

-h

-d

Displays help information about the command parameters.

Returns debugging information.

McAfee Web Gateway 7.8.0

Installation Guide 27

2 Setting up Web Gateway

Upgrading Web Gateway offline

Table 2-9 Parameters of the mwg-update tool (continued)

Parameter

-p <proxy>

Definition

The upgrade is performed using the specified proxy.

-y Answers all questions asked during the upgrade process with yes.

This parameter is useful when running a script to perform the upgrade.

-o <file name> The upgrade is performed offline using the specified ISO file.

28 McAfee Web Gateway 7.8.0

Installation Guide

Supported blade servers and enclosures

A blade server is a modular server that is installed in a blade system enclosure.

The blade server models that are provided for use with Web Gateway are also known as McAfee Blades.

Web Gateway can run on the following blade server models:

• ProLiant BL460c G6

• ProLiant BL460c G6.5

• ProLiant BL460C G8

The blade servers can be installed in the following enclosure models:

• M3 (c3000)

• M7 (c7000)

McAfee Web Gateway 7.8.0

Installation Guide 29

3 Supported blade servers and enclosures

30 McAfee Web Gateway 7.8.0

Installation Guide

Installing the blade server system

To run Web Gateway on a blade server, you need to install the blade system enclosure with the blade servers.

A blade system enclosure that has blade servers installed is referred to as a blade server system.

For a detailed description of how to install a blade server system, refer to the documentation of the McAfee partner (Hewlett-Packard) who provides blade servers for Web Gateway. The documentation is available on their website.

Contents

Preparing the installation of the blade server system

Install the blade server system

Preparing the installation of the blade server system

Several requirements must be met for installation of a blade server system.

When preparing the installation, the following is important to consider.

Environment of the blade server system

You need to consider the environment of the blade server system.

• Power and air conditioning

• Integration of the blade server system into your network

Completeness of shipment

You need to go through the shipping list to check whether you have received the appropriate items.

• Blade server enclosure (M3 or M7) with blade servers

• Power cords

• Network cables

IP addresses for the blade server system

The blade server system requires IP addresses for the following components:

• Onboard Administrator

• Integrated Lights Out (iLO) modules — 8 to 16 addresses (depending on your configuration)

• Interconnect modules — 4 addresses

• Blade servers (number of addresses depending on your configuration)

McAfee Web Gateway 7.8.0

Installation Guide 31

4 Installing the blade server system

Install the blade server system

For more detailed information, refer to the Site Planning Guide and the Setup and Installation Guide that is provided for each enclosure model on the website of the McAfee partner.

Install the blade server system

To install the blade server system, install the blade system enclosure, insert the interconnect modules in the enclosure, and turn on the enclosure.

Tasks

•

Install the blade system enclosure on page 32

To install the blade system enclosure, unpack it, install components, and connect a monitor and keyboard.

•

Install the interconnect modules on page 32

To install the interconnect modules, inserted them in the interconnect bays on the blade system enclosure.

•

Turn on the blade system enclosure on page 33

Supply power to the blade system enclosure and turn it on.

Install the blade system enclosure

To install the blade system enclosure, unpack it, install components, and connect a monitor and keyboard.

Task

1 Review and observe the safety information that is provided.

2 Remove the protective packaging and place the blade system enclosure on a flat surface.

Considering its weight, unpack the enclosure as close as possible to the intended location.

3 Remove the front and rear components, as well as the rear cage from the enclosure.

4 Install the power supplies and cooling fans.

We recommend that you install all power supplies and fans that were shipped with the enclosure to ensure redundancy in case one of these components fails.

5 Install the Onboard Administrator and the Integrated Lights Out System.

6 Connect a monitor and keyboard to the enclosure.

7 Attach power cords to the monitor and the enclosure, but do not yet connect the power supplies.

For more information, refer to the Setup and Installation Guide, the Onboard Administrator User Guide, and the

Integrated Lights-Out User Guide that are provided for each enclosure model on the website of the McAfee partner.

Install the interconnect modules

To install the interconnect modules, inserted them in the interconnect bays on the blade system enclosure.

The Onboard Administrator lets you view diagrams of the enclosure. Using the mouse-over function, you can locate the position of the interconnect bays on the rear side of the enclosure.

The M3 enclosure model has four interconnect bays, the M7 model has eight. These modules are either pass-through modules or switches.

32 McAfee Web Gateway 7.8.0

Installation Guide

Installing the blade server system

Install the blade server system

Task

1 Locate the positions of the interconnect bays.

2 Install the interconnect modules as follows.

• If your enclosure model is M3, insert four switches in interconnect bays 1 to 4.

• If your enclosure model is M7, insert four switches in interconnect bays 1 to 4 and two pass-through modules in interconnect bays 5 and 6.

Turn on the blade system enclosure

Supply power to the blade system enclosure and turn it on.

Task

1 Connect the power cords of the enclosure to the power supplies and the power outlets.

We recommend that you use two power circuits to ensure all blade servers in the enclosure turn on.

If you use only one circuit and the power management settings are configured for AC redundant

(which is also recommended), some blade servers will fail to turn on.

2 Turn on the blade system enclosure.

You can now install the Web Gateway appliance software on a blade server in the enclosure.

McAfee Web Gateway 7.8.0

Installation Guide 33

4 Installing the blade server system

Install the blade server system

34 McAfee Web Gateway 7.8.0

Installation Guide

Install Web Gateway on a blade server

To install Web Gateway on a blade server, download the appliance software, choose an installation device and a blade server, and perform the installation procedure.

You can download the Web Gateway appliance software in ISO or USB format from the McAfee Content & Cloud

Security Portal under https://contentsecurity.mcafee.com/software_mwg7_download

Different devices can be used to install Web Gateway on a blade server, depending on the enclosure model:

• Internal CD/DVD drive — M3

• External CD/DVD drive — M7

• USB drive — M3 and M7

• Virtual media — M3 and M7

After choosing an installation device, you need to complete one of the following tasks.

Tasks

•

Use the internal CD/DVD drive to install Web Gateway on a blade server on page 36

If your enclosure model is M3, you can use the internal CD/DVD drive to install the Web Gateway appliance software on a blade server in the enclosure.

•

Use an external CD/DVD drive to install Web Gateway on a blade server on page 36

If your enclosure model is M7, you can use an external CD/DVD drive to install the Web Gateway appliance software on a blade server in the enclosure.

•

Use a USB drive to install Web Gateway on a blade server on page 37

You can use a USB drive to install the Web Gateway appliance software on a blade server in either of the two enclosure models.

•

Use virtual media to install Web Gateway on a blade server on page 37

You can use virtual media to install the Web Gateway appliance software on a blade server in either of the two enclosure models. The blade system enclosure provides an option for a virtual installation of McAfee Web Gateway on a server in the enclosure using an ISO image that is stored on one of your local drives.

Contents

Use the internal CD/DVD drive to install Web Gateway on a blade server

Use an external CD/DVD drive to install Web Gateway on a blade server

Use a USB drive to install Web Gateway on a blade server

Use virtual media to install Web Gateway on a blade server

McAfee Web Gateway 7.8.0

Installation Guide 35

5 Install Web Gateway on a blade server

Use the internal CD/DVD drive to install Web Gateway on a blade server

If your enclosure model is M3, you can use the internal CD/DVD drive to install the Web Gateway appliance software on a blade server in the enclosure.

Task

1 Insert a CD or DVD with the Web Gateway appliance software on it in the internal CD/DVD drive of the enclosure.

2 Open the Onboard Administrator of the enclosure and select a blade server to install Web Gateway on.

3 Click the Virtual Devices tab.

4 Use this tab to connect the internal CD/DVD drive to the blade server.

5 Click the Boot Options tab and set One Time Boot from to CD-ROM.

6 Turn on the blade server.

7 Follow the instructions for installing Web Gateway that appear on the monitor you connected to the enclosure.

When the installation is completed, you can log on to the user interface of Web Gateway.

For information about logging on and how to continue, see the Setting up Web Gateway chapter in this guide.

Use an external CD/DVD drive to install Web Gateway on a blade server

If your enclosure model is M7, you can use an external CD/DVD drive to install the Web Gateway appliance software on a blade server in the enclosure.

Task

1 Insert a CD or DVD with the Web Gateway appliance software on it in the external CD/DVD drive.

2 Use the USB SUV cable that is shipped with the enclosure to connect the drive to the blade server you want to install Web Gateway on.

3 Open the Onboard Administrator of the enclosure and select the blade server.

4 Click the Boot Options tab and set One Time Boot from to CD-ROM.

5 Turn on the blade server.

6 Follow the instructions for installing Web Gateway that appear on the monitor you connected to the enclosure.

When the installation is completed, you can log on to the user interface of Web Gateway.

For more information about logging on and how to continue, see the Setting up Web Gateway chapter in this guide.

36 McAfee Web Gateway 7.8.0

Installation Guide

Install Web Gateway on a blade server

Use a USB drive to install Web Gateway on a blade server

You can use a USB drive to install the Web Gateway appliance software on a blade server in either of the two enclosure models.

Task

1 Use the USB SUV cable that is shipped with the enclosure to connect the USB drive to the blade server you want to install Web Gateway on.

2 Open the Onboard Administrator of the enclosure and select the blade server.

3 Click the Virtual Devices tab.

4 Click the Boot Options tab and set One Time Boot from to USB.

5 Turn on the blade server.

6 Follow the instructions for installing Web Gateway that appear on the monitor you connected to the enclosure.

When the installation is completed, you can log on to the user interface of Web Gateway.

For information about logging on and how to continue, see the Setting up Web Gateway chapter in this guide.

Use virtual media to install Web Gateway on a blade server

Gateway on a server in the enclosure using an ISO image that is stored on one of your local drives.

The blade system enclosure provides an option for a virtual installation of Web Gateway on a server in the enclosure using an ISO image that is stored on one of your local drives.

Task

1 Open the Onboard Administrator of the enclosure and select a blade server to install Web Gateway on.

2 Click iLO, then click Web Administration.

A new browser window opens providing access to the iLO (integrated Lights-Out) web user interface.

3 Click the Virtual Media tab, then click Virtual Media.

The Virtual Media window opens.

4 Choose the Virtual Floppy/USB Key or Virtual CD/DVD-ROM section of the window for installing Web Gateway and click Browse in the section.

5 Browse to the location where you stored the ISO image of the Web Gateway appliance software and click

Connect .

The ISO image becomes available for installation.

6 Follow the instructions for installing Web Gateway that appear on the monitor you connected to the enclosure.

When the installation is completed, you can log on to the user interface of Web Gateway.

For information about the logon and how to continue, see the Setting up Web Gateway chapter in this guide.

McAfee Web Gateway 7.8.0

Installation Guide 37

5 Install Web Gateway on a blade server

Use virtual media to install Web Gateway on a blade server

38 McAfee Web Gateway 7.8.0

Installation Guide

Network setup for Web Gateway on a blade server

After installing McAfee Web Gateway on a McAfee Blade, you can configure the network setup.

You can configure one of the following setups:

• Proxy HA (High Availability)

• Proxy with external load balancing

• Transparent router

• Transparent bridge

For each of these setups, you need to configure the appropriate settings on the user interface of McAfee Web

Gateway and complete additional configuration activities for the other network components.

Contents

Proxy HA on a blade server

Proxy with external load balancing on a blade server

Transparent modes on a blade server

Proxy HA on a blade server

You can configure the proxy HA (High Availability) mode for Web Gateway on a blade server. This mode provides the functions of a proxy that runs in explicit proxy mode combined with High Availability functions.

Network configuration

As this is a High Availability configuration, there must be multiple instances of Web Gateway on blade servers that run as nodes in this configuration. There must be at least two director nodes, so a failover can be performed in case one of them is down. A director node directs data packets to the nodes that scan the data in a suitable manner to enable load balancing.

We recommend that you configure the proxy HA mode as a two-legged proxy solution. This means the following is configured on a director node:

• Network interface for inbound web traffic

• Network interface for outbound web traffic

The network interface that handles inbound traffic must have a virtual IP address of its own. The network interface for outbound web traffic should also be used to do the load balancing. This is achieved by specifying its IP address as the physical component that is configured together with the management IP address.

McAfee Web Gateway 7.8.0

Installation Guide 39

6 Network setup for Web Gateway on a blade server

Proxy with external load balancing on a blade server

We also recommend that you configure the following on each director node:

• Network interface for out-of-band management

Configuring this network interface allows you to perform management communication separately.

• Network interface for internal communication within the blade system enclosure

This network interface has its IP address configured under VRRP (Virtual Router Redundancy Protocol).

Link resilience

If switches are installed as interconnect modules on an enclosure, link resilience can be achieved in the following way:

• Two of the ports used as uplink ports on a switch are bundled in a trunk group.

• Each of these ports is connected by a network cable to a physical link.

This means that if one the two links fails, the trunk group remains still active.

The interconnect modules and the trunk groups are mapped to the ports on the network interfaces, for example, as shown in the following table. For the network interface that handles internal communication, no port mapping to a trunk group is required.

Table 6-1 Mapping of network components in a proxy HA configuration

Port on network interface

Inbound web traffic interface

Outbound web traffic interface

Out-of-band management interface

Internal communication interface

Interconnect module

Switch in interconnect bay 1

Switch in interconnect bay 2

Switch in interconnect bay 3

Switch in interconnect bay 4

Trunk group

Group 1: port 21, port 22

Group 2: port 21, port 22

Group 3: port 21, port 22 no uplink ports required

For more information on how to configure the interconnect modules, refer to the GbE2c Ethernet Blade Switch for

c-Class BladeSystem Application Guide that is available on the website of the McAfee partner.

Proxy with external load balancing on a blade server

You can configure the explicit mode for Web Gateway on a blade server with load balancing performed by an external device.

Network configuration

We recommend that you configure a two-legged proxy solution for this mode, with two separate network interfaces on each blade server for inbound and outbound web traffic. Each of these interfaces is configured with an IP address of its own.

Additionally, a network interface for out-of-band management should be configured, which allows you to perform also management communication separately.

Load balancing

Load balancing is performed in this configuration not by one of the blade servers, but by an external load balancer, which directs load to the blade servers. For this purpose, the blade servers are included in a load balancing pool.

When configuring the load balancer, an algorithm can be configured that supports IP client stickiness. This ensures that functions requiring IP client stickiness are available, for example, a progress page.

40 McAfee Web Gateway 7.8.0

Installation Guide

Network setup for Web Gateway on a blade server

Transparent modes on a blade server

Link resilience

If switches are installed as interconnect modules on an enclosure, link resilience can be achieved in the following way:

• Two of the ports used as uplink ports on a switch are bundled in a trunk group.

• Each of these ports is connected by a network cable to a physical link.

This means that if one the two links fails, the trunk group remains still active.

The interconnect modules and the trunk groups are mapped to the ports on the network interfaces, for example, as shown in the following table.

Table 6-2 Mapping of network components in an explicit proxy configuration with external load balancing

Port on network interface Interconnect module Trunk group

Inbound web traffic interface

Outbound web traffic interface

Out-of-band management interface

Switch in interconnect bay 1

Switch in interconnect bay 2

Switch in interconnect bay 3

Group 1: port 21, port 22

Group 2: port 21, port 22

Group 3: port 21, port 22

For more information on how to configure the interconnect modules, refer to the GbE2c Ethernet Blade Switch for

c-Class BladeSystem Application Guide that is available on the website of the McAfee partner.

Transparent modes on a blade server

You can configure transparent modes for Web Gateway on a blade server.

In these modes, Web Gateway runs as a transparent router that directs data packets between segments of your network or serves as a transparent bridge that allows the transferring of data packets between these segments.

Transparent router

We recommend that you configure the transparent router mode as a two-legged proxy solution, with two separate network interfaces for inbound and outbound web traffic.

Each of the network interfaces is configured with its own IP address under VRRP (Virtual Router Redundancy

Protocol).

The outbound network interface should be used for load-balancing the traffic. This is achieved by specifying its

IP address as the physical component that is configured together with the management IP address.

If IP spoofing is configured, the blade servers on which Web Gateway only scans web traffic, without also directing it, do not need a connection for inbound web traffic. Inbound and outbound traffic is handled by an instance of Web Gateway that runs as a director node on a blade server.

Transparent bridge

We recommend that you configure also the transparent bridge mode as a two-legged proxy solution, with two separate network interfaces for inbound and outbound web traffic.

For this network mode, the two-legged solution does not require virtual IP addresses and no communication under VRRP is performed accordingly.

When configuring the management IP address, you need to specify the IP address of the network interface that has been configured as the ibr0 bridge interface.

McAfee Web Gateway 7.8.0

Installation Guide 41

6 Network setup for Web Gateway on a blade server

Transparent modes on a blade server

The director node that does the load-balancing is assigned this role according to the STP (Spanning Tree

Protocol).

To ensure that the director node is correctly assigned under STP, you need to disable the use of STP on switches in the enclosure for inbound and outbound web traffic. STP is then run by the operating system.

When the load balancing role on a director node is assigned under STP, this protocol must be disabled on the switches not only if Web Gateway runs on a blade server, but also if it runs on an appliance box or on a virtual machine.

42 McAfee Web Gateway 7.8.0

Installation Guide