Upgrading V-Series Appliances to v7.7

Deployment and Installation Center | Web and Email Security Solutions | Version 7.7.x

Applies to:

In this topic

Web Security, Web Security Gateway and Web Security Gateway Anywhere, v7.6.x

Email Security Gateway and Email Security Gateway Anywhere, v7.6.x

V10000, V10000 G2 and V5000 G2, v7.6.x

Versions supported for upgrade

Estimates of time to complete upgrade

Preparing for the appliance upgrade

Upgrade instructions

Upgrading multiple V-Series appliances

Post-upgrade activities

Use this information to upgrade existing V-Series appliances in:

Web and Email mode

Web Security and Email Security Gateway (Anywhere)

Web Security Gateway (Anywhere) and Email Security Gateway (Anywhere)

Web only mode

Web Security

Web Security Gateway (Anywhere)

Email only mode

Email Security Gateway (Anywhere)

In addition to upgrading your appliances, you must also upgrade Websense components installed on other servers.

The order of upgrade is important. Follow the steps prescribed for each solution or combination of solutions.

Upgrading Websense Web Security Solutions

Upgrading Data Security to v7.7.x

Upgrading Email Security Gateway to v7.7

Upgrading solutions that include Web, Email, and Data Security

Versions supported for upgrade

You can upgrade directly to version 7.7.x from these versions of 7.6:

7.6.0, 7.6.1, 7.6.2, 7.6.5

Appliances running earlier versions must be upgraded to one of the above versions before upgrading to version 7.7.x.


	Note The upgrade to version 7.7.3 and 7.7.4 is applied to V-Series appliances via a software patch. Patches are installed via the Appliance Manager under the Administration > Patches/Hotfixes > Patches page. You must be running version 7.7.0 to use the version 7.7.3 or 7.7.4 patch.

Estimates of time to complete upgrade

The table below provides estimates of the time needed for the 7.7.x patch to be installed on an appliance. The amount of time varies, as indicated. Not all V-Series configurations are shown.


System	Configuration	Elapsed time
V10000 G2	Web security only: Web Security Gateway Full policy source	70 - 90 minutes
V10000 G2 V5000 G2	Web security only: Web Security Gateway User directory and filtering	90 - 110 minutes
V10000 G2	Dual mode: Web Security Gateway and Email Security Gateway	70 - 90 minutes
V10000 G2 V5000 G2	Email security only	20 - 30 minutes

The following provides a basic sample scenario:

Approximate total upgrade time, beginning to end, for all upgrade tasks:

1 Dual mode V10000 G2 appliance

2 Windows 2008 Server R2 servers: 1 for TRITON console, 1 for Web and Email Log Server

3 hours and 10 minutes

Activity breakout:

15 minutes to download the version 7.7 appliance upgrade (patch) file

10 minutes to back up the V-Series appliance

70 to 90 minutes for the patch to perform the upgrade

10 minutes to restart the V-Series and verify that the upgrade was successful

20 minutes to download the version 7.7.x Websense TRITON Unified Installer

40 to 60 minutes to run the installer to upgrade on the TRITON management server and the Log Server host

5 minutes to restart the Windows servers and verify that the upgrade was successful

Service disruption during upgrade

Appliance services are disrupted while the upgrade is applied and until the appliance completes a restart. See Estimates of time to complete upgrade.


	Note Service is not disrupted while the off-box components are upgraded.

At completion of the V-Series upgrade, the appliance must be restarted.

Preparing for the appliance upgrade

Before applying the 7.7.x patch, perform the following tasks and be aware of the following issues.

If you are not already familiar with the preparation required for upgrade of off-appliance components, review those requirements before upgrading your appliances.

For Web Security solutions, see Before upgrading Web Security to v7.7.

For Email Security Gateway (Anywhere), see Preparing for the upgrade.

Back up appliance configuration and settings

Perform a full appliance configuration backup:

Log on to Appliance Manager and go to the Administration > Backup Utility page.

Under Perform Backup, select Full Appliance Configuration as the backup type.

Click Run Backup Now.

When the backup file appears in the Local Backup Files list, click the backup file name. When prompted, save the backup file in another location.

Content Gateway logs

If the appliance hosts Web Security Gateway (Anywhere), during the upgrade, depending on their size, older Content Gateway logs may be automatically removed by the upgrade procedure.

To ensure that all Content Gateway logs are retained, you can download the Content Gateway logging directory.

In the Appliance Manager, go to Administration >Logs.

Select the Websense Content Gateway module and then Download entire log file.

Click Submit and specify a location to save the file.

Policy databases and Websense databases are not affected by the upgrade.

Content Gateway Integrated Windows Authentication (IWA) settings

IWA settings are not preserved in the upgrade.

If your deployment uses Content Gateway IWA user authentication, log onto Content Gateway and record the IWA settings, including the name of the domain to which IWA is joined. Keep this record where you can easily retrieve it after upgrade is complete.

Network Agent settings

In the majority of deployments, upgrade preserves all Network Agent settings.

However, when the following conditions are true, the upgrade process does not preserve several Network Agent settings:

There is a Filtering only appliance that is configured to get policy information from the Policy Broker machine (either the Full policy source appliance or an off-appliance software installation).

There is an off-appliance Network Agent installation that uses the Filtering Service on the Filtering only appliance, and uses the Policy Server on the Policy Broker machine.

When the above conditions are true and the upgrade is performed, the settings for the off-appliance Network Agent installation are not retained.

In this case, record your Network Agent settings (configured in TRITON - Web Security) before performing the upgrade. Go to the Local Settings page for each Network Agent instance (Settings > Network Agent > agent_IP_address) and record all of its settings.

The following local settings are not preserved.

Filtering Service IP address

If Filtering Service is unavailable

NIC Configuration settings (from the Settings > Network Agent > NIC Configuration page for each NIC) are also not preserved:

Use this NIC to monitor traffic

Monitor List

Monitor List Exceptions

Save your record where you can easily access it when the upgrade is complete.

Websense administrator accounts

Make sure Websense administrator accounts authenticated by a directory service have an email address specified in the directory service. In version 7.7, an email address is required for each administrator account (except group accounts).

Content Gateway changes

See the Content Gateway Release Notes for information about enhancements and changes in version 7.7.0.

If you are upgrading to version 7.7.3, see the Content Gateway Release Notes for information about enhancements and changes in version 7.7.3.

If you are upgrading to version 7.7.4, see the Content Gateway Release Notes for information about enhancements and changes in version 7.7.4.

SSL Manager

SSL Manager has been enhanced in several ways. See the release notes for more information.

Of particular note, a few Certificate validation options have changed. Users of Certificate validation should review the changes and adjust their settings.

IPv6

Incremental support is added in version 7.7. See the release notes for more information.

Disable on-appliance TRITON - Web Security if both on- and off-appliance instances used in prior version

If you had both on- and off-appliance instances of TRITON - Web Security running in version 7.6.x (not recommended), disable the on-appliance instance after upgrading the appliance to version 7.7. To disable the on-appliance TRITON - Web Security:

Log on to the Appliance Manager (https://<C interface IP address>:9447/appmng)

Under Configuration, select Web Security Components.

Under TRITON - Web Security, select Disabled.

Click Save.

The disabling process may take several minutes. Wait for it to complete.

When the process completes successfully, a TRITON Configuration link appears below the Disabled option.

Use this link if you want to create a backup of TRITON settings that can be restored to the off-appliance TRITON Unified Security Center:

Click the backup file link that is displayed below the Disabled button.

If a certificate error is displayed, click the continue or accept option to start the download.

Save the TRITON backup file (EIP_bak.tgz) in a convenient location.

Upgrade instructions


	Important V-Series appliance services are not available while the patch is being applied and until the appliance completes its restart. See Estimates of time to complete upgrade. It is best to perform the upgrade at a time when service demand is low.

If you have multiple V-Series appliances, read Upgrading multiple V-Series appliances before following this procedure.

Take all precautions to ensure that power to the V-Series appliance is not interrupted during the upgrade. Power failure can result in operating system and software component corruption.

Back up appliance configuration and settings. See Back up appliance configuration and settings.

Restart the appliance (in Appliance Manager: Status > Modules > Restart Appliance).

To download the upgrade patch, in the Appliance Manager, go to the Administration > Patches/Hotfixes > Patches tab. The 7.7.x upgrade patch should be listed in the Table of available patches. If it's not, click Check for Patches. The 7.7 patch should be listed as available.

Alternatively, the patch can be downloaded from websense.com and uploaded to the appliance.

Go to MyWebsense.com and select the Downloads tab. Click Get Hotfixes & Patches. Select your appliance model and version.

Log on to the Appliance Manager and navigate to Administration > Patch Management.

Click Browse, and select the v7.7.x upgrade file.

Click Upload. After a few seconds, the upgrade is listed in the Uploaded patches list.

This is an efficient method when your deployment has many appliances because the download from Websense occurs only once. Other appliances can upload the patch from the local location.

Click Install to apply the upgrade.


	Important When patch installation begins, a dialog box indicates that the patch will take 5 to 10 minutes to apply. This is incorrect. The time is significantly longer. See Estimates of time to complete upgrade.

While the upgrade is being applied, services are unavailable to users.

When patch installation is complete, restart the appliance right away; click Restart Now when prompted. Do not cycle the power.

When the appliance has restarted, log on to the Appliance Manager and verify on the Configuration > General page that the V-Series version is 7.7.x.

Next go to the System > Configuration page and confirm and adjust, if necessary, the Time and Date settings, paying particular attention to the time zone setting.

In rare cases, when logging onto the Appliance Manager for the first time after upgrade, your browser may show an HTTP Status - Internal Error page. If this occurs, cycle the power to the appliance. Once the appliance has restarted, you should be able to log in.

If you have multiple appliances, upgrade them all. See Upgrading multiple V-Series appliances.

10.

Upgrade all Websense components running off the appliance (including the TRITON management server, Web and Email Security Log Server, transparent identification agents, and so on).

See Upgrading Websense Web Security Solutions and Upgrading Email Security Gateway to v7.7 for instructions.

Upgrading multiple V-Series appliances

When multiple V-Series appliances are deployed in the same network, it is very important that they be upgraded in the prescribed order.

If the appliance is an Email mode (only) appliance

Apply the 7.7.x upgrade patch before upgrading the off-appliance components.

Best practice for upgrade sequence if Full policy source is on V-Series appliance

Follow this sequence whether the Full policy source is a Web mode (only) or Web and Email mode appliance.

Upgrade the Full policy source V-Series appliance and immediately restart when the upgrade completes.

Sequentially apply the upgrade to all User directory and filtering appliances. Restart each appliance when the upgrade completes.

Sequentially apply the upgrade to all Filtering only appliances.

Restart each appliance when the upgrade completes.

After all appliances have been upgraded, upgrade off-box components.

Best practice for upgrade sequence if Full policy source is not on V-Series appliance

If you have multiple V-Series appliances and the policy source (Policy Broker and Policy Server) is located off-appliance:

Use the version 7.7 Websense installer to upgrade the Policy Broker system. See Upgrading Websense Web Security Solutions for instructions.

Sequentially apply the upgrade to all User directory and filtering appliances. Restart each appliance when the upgrade completes.

Sequentially apply the upgrade to all Filtering only appliances.

Use the version 7.7.x Websense installer to upgrade remaining off-appliance components. See Upgrading Websense Web Security Solutions for instructions.

If the Full policy source appliance is down or unavailable

Best practice is to upgrade the Full policy source appliance first, then the User directory and filtering, then Filtering only appliances, and finally the off-appliance Websense components.

However, if your site must upgrade a User directory and filtering or Filtering only appliance before the Full policy source appliance, or if your Full policy source appliance is unavailable, is being replaced, or is being re-imaged, then set a User directory and filtering or Filtering only appliance (temporarily) to be the Full policy source. To do this:

On that secondary appliance, in the V-Series console, navigate to Configuration > Web Security Components.

For Policy Source, select Full policy source. Save the setting.

Upgrade this appliance to version 7.7.x and restart it.

After the original Full policy source appliance has been upgraded, replaced, or re-imaged, change the upgraded temporary Full policy source machine to point to the original Full policy source again for its policy information. To do this:

Upgrade the primary appliance and restart it.

On the previously upgraded secondary appliance, in the V-Series console, navigate to Configuration > Web Security Components.

For Policy Source, select User directory and filtering or Filtering only and enter the IP address of the primary appliance. Save the setting.

Use the version 7.7.x Websense installer to upgrade remaining off-appliance components. See Upgrading Websense Web Security Solutions for instructions.

Post-upgrade activities

If your appliance includes Email Security Gateway (Anywhere), perform the Email Security Gateway Post-upgrade activities.

If your appliance is a Web Security Policy Server, log onto TRITON console, go to the TRITON - Web Security Settings > General > Policy Servers page and add the appliance. Next go to the TRITON console Appliances tab and register the appliance.

If your appliance includes Web Security Gateway (Anywhere), perform the Content Gateway Post-upgrade activities.

If your appliance uses the Network Agent module, Verify Network Agent settings.

Review the Release Notes for the Websense solutions on your appliances (links provided below). There are several new features that may require some configuration to put into effect.

Web Security users will be especially interested in the Threats dashboard (no configuration needed). Web Security Gateway (Anywhere) users will be interested in the enhanced outbound scanning options. It is recommended that all of the Scanning Options be reviewed.

Web Security Release Notes