(Manual) Installing the agent for Hybrid DLP with Web Security

This section outlines the steps to manually install the Forcepoint Agent on a macOS endpoint system for hybrid DLP and Web Security Proxy Connect (PCEP) or Direct Connect (DCEP) with no existing agent installations.

1. Obtain the installation package and unzip.

   The zip file contains:

   • WebsenseEndpoint.pkg
   • manifest.json
2. Obtain the ca.cer and localconfig.xml files from the DLP manager in FSM, located at C:\Program Files (x86)\Websense\Data Security\client.
3. Place the ca.cer and localconfig.xml files in the unzipped installer package.
   Note: If using a custom ca.cer with multiple certificates, ensure that the cert and key for the DLP manager are placed first in the ca.cer file and any other certs are placed after this.
4. In the Forcepoint Portal, for the appropriate profile in Endpoint management > Profiles, verify that the Managed by mode under Data Protection is set to On-Premise, and upload the same ca.cer and localconfig.xml used in the installer package. Ensure this is done in the profile that contains the device on which the agent will be installed.

   

5. For Web Security PCEP installations, obtain the Forcepoint Cloud CA certificate:
   1. Go to the Forcepoint Cloud Security Gateway portal.
   2. Select the policy from Account > Policies, and then click Web Categories.
   3. Click Forcepoint LLC root certificate(s), and save the certificate.

      

6. Double-click WebsenseEndpoint.pkg, then click Allow.
7. To begin the installation, click Continue.
   
8. In the license agreement notification that appears, click Agree.
9. On the next screen, click Install.
   
10. When prompted, enter the admin password:
    
11. Click Open System Settings on the following window which opens the windows to enable the Network Extensions:

    

    

    Turn on fppnehost and enter the credentials to enable it.
12. To add proxy configurations, click Allow.
    
13. Click Allow to modify apps on your mac and then click Done.

    

    A message appears to enable full disk access to the required files.

    

14. Click Open Full Disk Access.
15. On the Full Disk Access tab enable the following applications:
    

    Application	Path
    EndpointClassifier	Library/Application Support/Websense Endpoint/EPClassifier/EndPointClassifier
    ESDaemonBundle	Library/Application Support/Websense Endpoint/DLP/ESDaemonBundle.app
    AEserver	Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/Support/AEServer
    FPEPAgent	Library/Application Support/Websense Endpoint/Cloud/FPEPAgent
    F1E Helper	Library/Application Support/Websense Endpoint/F1E/F1E Helper.app
    Websense Endpoint Helper	Library/Application Support/Websense Endpoint/DLP/Websense Endpoint Helper.app
    wsdlpd	Library/Application Support/Websense Endpoint/DLP/wsdlpd
    service	Library/Application Support/Websense Endpoint/Cloud/Service
    MBBroker	Library/Application Support/Websense Endpoint/Cloud/MBBroker

16. Once the agent is successfully installed, open the Keychain Access application, and trust the localhost certificate Forcepoint F1E NP Root CA and the Forcepoint Cloud CA certificate:
    1. Double-click the localhost certificate, Forcepoint F1E NP Root CA, and then select Always Trust for all.

       

    2. Double-click the Forcepoint Cloud CA certificate, and then select Always Trust for all.

       

       Note: If the Forcepoint Cloud CA certificate does not appear in the Keychain Access application, you will need to add it manually. Download the certificate from the Forcepoint Cloud Security Gateway portal (as described in Step 5) and then drag it into the System > Certificates tab of Keychain Access before proceeding with trusting it.