How do I restore my Websense software configuration

Problem Description

I want to restore my Websense software configuration or revert to an earlier configuration. How do I do this?

Resolution

For version 7.6.x, see the Backup and Restore FAQ article.

For v7.0-7.5, use the information within this article:

Use the Websense Backup Utility to restore a saved Websense software configuration.
 
When you restore Websense configuration data, make sure that you are restoring data for the components that exist on the current machine. Also, do not restore files backed up on one platform to a machine running a different platform (Windows to Linux or Linux to Windows).
 
To initiate the restore process:

1. Make sure that all administrators have logged out of Websense Manager.
2. Open a command prompt on the machine whose Websense configuration you want to restore or revert.
3. Navigate to the appropriate directory:
   • Windows: C:\Program Files\Websense\bin (by default)
   • Linux: /opt/Websense (by default)
4. Enter the following command:
   • Windows:    wsbackup -r -f archive_file.tar.gz
   • Linux:    ./WebsenseTools -b -r -f archive_file.tar.gz
   Substitute the full name and path of the actual backup file that you are using to restore your configuration.

NOTE: The wsbackup executable is available from the /opt/Websense/bin directory on Linux machines. You must run the command "export LD_LIBRARY_PATH=." from the bin directory to use the utility directly.
  The restore process may take several minutes. Do not stop the process while restoration is underway.
 
During the restore process, the Websense Backup Utility stops all Websense services, including the ApacheTomcatWebsense service. If the utility is unable to stop the services, it sends a message asking you to manually stop them.
 
The Backup Utility saves some files used for communication with third-party integration products. Because these files reside outside the Websense directory structure, you must restore them manually, by copying each file to the correct directory.

Notes & Warnings

• When restoring to a new server, Websense components must be installed on the same drive.
  • If the new Websense components are installed on a different drive, then extract the policy.wsdb file and restore the policy database using the PgSetup command. Afterwards, all filtering policies are available but all other settings, such as Active Directory, must be manually configured.
• Ensure all administrators are logged off of Websense Manager before initiating the restore process.
• The restore process may take several minutes. Do not stop the process while restoration is underway.

Websense Manager Help (Server Administration)

How do I back up my Websense filtering configuration

Problem Description

I want to back up my Websense filtering policies and configuration information. Which files should I back up? How should I perform the backup?

Resolution

Websense software includes a command-line Backup Utility that makes it easy to back up your Websense software settings and policy data, and to revert to a previous configuration. Data saved by the utility can also be used to import Websense configuration information after an upgrade.
The Websense Backup Utility saves:

• Global configuration information, including client and policy data, stored in the Policy Database.
• Local configuration information, such as Filtering Service and Log Server settings, stored by each Policy Server.
• Websense component initialization and configuration files.

You can manually initiate the backup process at any time, or schedule the backup process to run at a regular interval.
Backup files are given the name "wsbackup_yyyy-mm-dd_hhmmss.tar.gz", where yyyy-mm-dd represents the date and hhmmss represents the time that the file was created. The file is placed in the directory that you specify when running or scheduling the backup.

To run an immediate backup:

1. Open a command prompt on any machine that includes Websense filtering and reporting components.
2. Navigate to the appropriate directory:
   • Windows: C:\Program Files\Websense\bin (by default)
   • Linux: /opt/Websense (by default)
3. Enter the following command:
   • Windows:    wsbackup -b -d <directory>
   • Linux:    ./WebsenseTools -b -b -d <directory>
   Here, directory indicates the destination directory for the backup archive. Do not store backup files in the Websense directory structure.

The backup file is created and saved in the directory that you specified. The amount of time required for the backup depends on which Websense filtering components reside on the machine at the time of the backup.

To schedule backups:

IMPORTANT	On some operating systems, attempts to use the "-s" parameter to schedule backups fail. One workaround is to use a script to run a standard backup ("-b" parameter) at regular intervals. This article will be updated when more information is available.

1. Open a command prompt on any machine that includes Websense filtering and reporting components.
2. Navigate to the appropriate directory:
   • Windows: C:\Program Files\Websense\bin (by default)
   • Linux: /opt/Websense (by default)
3. Enter the following command:
   • Windows:    wsbackup -s -t "<minute> <hour> <day_of_month> <month> <day_of_week>" -d <directory>
   • Linux:    ./WebsenseTools -b -s -t "<minute> <hour> <day_of_month> <month> <day_of_week>" -d <directory>
   Refer to the table below to construct the appropriate command.

When you schedule backups, the time information uses crontab format. The quotation marks and spaces shown in the command example are required. Each parameter can take a numeric value (specified in the table below), an asterisk ("*") to indicate all, or a list of values (separated by commas). For example:
   wsbackup -s -t "31 1 * * 1,3,5" -d z:\backups\ws
Here, the backup is scheduled to run at 1:31 a.m. on Monday, Wednesday, and Friday, regardless of date, every month of the year. The backup file is stored in the "z:\backups\ws" directory.

Variable	Information
<minute>	0 - 59 Specify the precise minute to start the backup.
<hour>	0 - 23 Specify the general hour of the day to start the backup.
<day_of_month>	1 - 31 Specify the date to perform the backup. If you schedule a backup for days 29 - 31, the utility uses the standard substitution procedure for the operating system in months that do not include that date.
<month>	1 - 12 Specify the month to perform the backup.
<day_of_week>	0 - 6 Specify a day of the week. 0 represents Sunday.

Refer to any crontab reference for more information about valid scheduling parameters.

Related Articles:

• How do I restore my Websense filtering configuration?
• Which files does the Backup Utility save?

Notes & Warnings

• Do not store your backup files in the Websense bin directory. Store them in a safe location that is included in your organization's regular backup processes.
• Make sure that all administrators are logged out of Websense Manager before initiating a backup.
• When specifying a directory for the backup file, do not include a trailing slash ("C:\wsbackupfiles" not "C:\backups\").

RESTORING POLICY INFORMATION

RESTORING POLICY INFORMATION

Once you have policy.wsdb file and the broker service token from the source server, then you can transfer your policies to another v7.x Websense installation.

The restore process imports only your policies (clients, policies, filters, and admins) to the destination server. It is recommended to back up the destination server's policy information prior to doing a restore. The restore replaces the default WebsenseAdministrator password, so ensure you know the password from the source server.

To restore your policies, complete the following steps on the destination server:

1. From the Websense bin directory, back up the existing policy database:
   • Windows:  PgSetup --save 7x.backup_policy_db
   • Linux:  ./PgSetup --save 7x.backup_policy_db  
2. Store the backup file, generated in step one, in a safe location.
3. Stop all Websense services.
   • How Do I Stop And Start Websense Web Security and V-Series Services?
4. Move the policy.wsdb file (created on the source server) into the Websense bin directory on the destination server.
5. From the Websense bin directory, restore the policy database by running:
   • Windows:  PgSetup --restore policy.wsdb
   • Linux:  ./PgSetup --restore policy.wsdb
6. If you are migrating your policy database to a later Websense version, then from the Websense bin directory, run the following additional command:
   • Windows:  PgSetup --upgrade
   • Linux:  ./PgSetup --upgrade
7. Delete or rename the following two files from the Websense bin directory:
   • config.xml.bak
   • journal.dat
8. Synchronize the config.xml password with policy database.
   1. From the Websense bin directory, open the config.xml file and search for the word "token" including the quotes. 
   2. Replace the token value (the long string of numbers) with the saved token from the source installation server's config.xml file. 
   3. Save and close config.xml file.
9. Restart all Websense Services.

BACKING UP POLICY INFORMATION

You can back up Websense policy information (clients, policies, filters, and admins) using the PgSetup utility. However, when running PgSetup to restore policies on another Websense installation, you will also need to change the broker service token in config.xml file (see below for a PgSetup restore). On the source server, perform the following.

1. Generate a policy backup file. From the Websense bin directory, run:
   
   • Windows:  PgSetup --save policy.wsdb
   • Linux:  ./PgSetup --save policy.wsdb
2. From the Websense bin directory, open the config.xml file and search for the word "token" including the quotes. You should see something like:
   
   • <data name="Token"> LONG-TOKEN-STRING-HERE </data> 
3. Copy the token string and save it to a text file. 
4. Move the policy.wsdb file and token string to the destination server.

NOTE: Your WebsenseAdministrator password will be used on the destination server where this token is used.

Websense Product Cimponents

The primary Websense components include:
‹ Policy Database
‹ Policy Broker
‹ Policy Server
‹ Filtering Service
‹ Network Agent
‹ Master Database
‹ Websense Manager
‹ Usage Monitor
‹ User Service
‹ Log Server
‹ Log Database


Websense software also includes optional transparent identification agents:
‹ DC Agent
‹ RADIUS Agent
‹ eDirectory Agent
‹ Logon Agent


Additional optional components include:
‹ Remote Filtering Server
‹ Remote Filtering Client
‹ Websense Content Gateway

WCCP Cache Registration

WCCP defines the router as a server and the proxy as a client. The proxy registers
with the WCCP server (configurable between 0-255) and sends a “Here I Am”
message every 10 seconds. The router (WCCP Server) responds with an “I See You”
message. If the “Here I Am” message misses on 3 consecutive tries (30 seconds), the
proxy is marked as failed

WCCP

Web Cache Communication Protocol (WCCP):


WCCP provides for the communication between routers and web
caches as well as load balancing and fault tolerance.WCCP is supported on various models of Cisco routers and Layer 3 switches. WCCPv2 requires the equipment to have at least IOS version 12.0(3).


WCCP v2 can be used for various protocols; HTTP, HTTPS and FTP over HTTP are
all common choices, because they can make use of caching and proxying. WCCP does
not support IPv6, so it should not be used in IPv6 deployments.

WCCP Data Flow:


Client requests get redirected to the proxy. The proxy makes a connection to the
requested server and then sends the results back to the client.
The steps involved are as follows:

1. Client sends traffic via the router to some destination (no proxies are
configured on the client).

2. WCCP v2 router depending on its configuration sends some traffic (such as
HTTP, HTTPS, FTP, and DNS) to appropriate service group, so it may reach
proxy server or cluster of servers in that service group.

3. The Adaptive Redirection Module (ARM) readdresses traffic. For example,
HTTP traffic on port 80 is readdressed to Content Gateway port 8080. The
proxy processes the request as usual, then the traffic hits the router again.

4. Request is sent to the destination.

5. Return traffic reaches the WCCP router and is redirected based on return rules
in the router.

6. The ARM readdresses the proxy port in the response header to port 80
(undoing the readdressing it did on the way to the proxy). As a result, the user
sees the response as if it had been sent directly from the origin server.


The ARM (steps 3 and 6) can make two changes to the address of an incoming packet:
its destination IP address and its destination port. For example, the destination IP
address of an HTTP packet is readdressed to the IP address of the proxy and the
destination HTTP port is readdressed to the Websense Content Gateway HTTP proxy
port (default port 8080). On the way back to the client, the ARM changes the source
IP address to the origin server IP address and the source port to the origin server po