LevelBlue Knowledge Base » Knowledgebase » Legacy Products » Secure Web Gateway » Installations

Usage of external CA certificates

Charles Creegan — Wed, 01 Apr 2020 00:00:00 GMT

This article applies to:

WebMarshal

Question:

How can I use external CA certificate with WebMarshal?

Information:

Use of publicly trusted CA certificates in proxying end-user communications with internet systems is prohibited by some browser manufacturer rules and regulations. LevelBlue recommends the use of a self signed or enterprise CA for proxying use. If you intend to use a publicly trusted or cross signed CA certificate with this product, consult with the issuing CA to ensure your use is compliant with all current and anticipated regulations.

To import a CA certificate, you can use the Certificate Converter Tool available from the WebMarshal Download page.

Version 11.5 End of Maintenance

Shawn Cook — Thu, 10 Nov 2016 11:17:36 GMT

This article applies to:

SWG 11.5

Information:

The purpose of this notice is to inform you that the End of Maintenance period for Secure Web Gateway version 11.5 will be on October 19, 2016.

To assist you in making the transition to a later, supported SWG version, we will extend the support period for an additional 6 months, until April 19, 2017 (SWG version 11.5’s End of Life). During that time, you will still receive database downloads and security patches. Once the End of Life occurs, Trustwave will stop supporting SWG Version 11.5.

To keep your Trustwave SWG Appliances up-to-date and supported, please upgrade to version 11.6, 11.7 or later. Doing so will ensure your Trustwave SWG Appliances are updated and supported. We recommend that you upgrade to our latest available version in order to enjoy our latest enhancements.

More information on the policy including definitions of key terms can be found in the Secure Web Gateway Life Cycle Support Policy.

The latest SWG versions and documentation can be found on the Secure Web Gateway product pages.

Please contact Customer Support if you need guidance and information on the upgrade process.

Install SWG v11.8 on Hyper-V

Shawn Cook — Wed, 02 Nov 2016 14:54:49 GMT

This article applies to:

SWG v11.8

Question:

What are the VM specifications for installing SWG v11.8 on a Hyper-V system?

Answer:

RAM: 4GB (4000MB)

HDD: 150GB

CPU: 1 Virtual Processor

Notes:

1) Installing SWG on Hyper-V system should be performed with the ISO image

2) On installation using the ISO image, select "vm" to install on the Hyper-V virtual machine.

MHF/RHF patch, what is it and how is it installed ?

Charles — Wed, 23 Apr 2014 15:27:23 GMT

This article applies to:

SWG v10.x
SWG v11.x

Question:

What are the differences between MHF and RHF patches ?
How should these patches be installed ?
Is there any specific order of installation ?

Information:

MHF patch is a Maintenance Hot Fix, mainly addressing issues of the Policy Server role in SWG OS.
RHF patch is a Run-time Hot Fix, addressing issues of the Scanning Server role in SWG OS.

These patches are installed as local updates, refer to below KB article for installation procedure guidelines:
Q13868: Install local updates on SWG appliances
Q14452: .fup installation for SWG

There are no internal dependencies between MHF and RHF patches, no specific order of installation is required.
These patches are cumulative, and newer version of MHF/RHF patch will include the libraries included in the previous version of the MHF/RHF patch, respectively.

Patch usually consists of Debian libraries that are being updated from version to version, as shown below for example:

The patch is always installed first on the Policy Server and then the Policy Server is responsible to update internally the scanner(s) managed by this Policy Server.
The installation order is also similar in the case of HA Policy Server, once the patch is installed on the Active Policy Server, it will also be installed on the Backup Policy Server.

Refer to the below KB articles for the links to the most recent patches for different SWG OS versions:
SWG v10.2 - Q16783
SWG v11.0 - Q16784
SWG v11.5 - Q16785

Quickly rebuild an SWG Virtual Scanner

ofer Kalef — Tue, 11 Feb 2014 01:24:40 GMT

This article applies to:

SWG 10.x
SWG 11.x

Question:

What is the easiest way to recreate an SWG virtual scanner?

Procedure:

1. Remove the virtual scanner from the list of scanners in the Policy Server GUI (right-click the scanner and choose Delete).

2. Download the scanner VMDK and OVF files from the Trustwave SWG download page: https://support.levelblue.com/Secure-Web-Gateway/Upgrade.asp

3. Delete the scanner virtual machine from the VM environment.

4. Create the new scanner VM by placing the OVF and VMDK files in the same folder, and then drag/drop the OVF into the VMware instance (or create the new VM and select the OVF file).

The Scanner should build itself and complete.

5. Boot the new VM scanner and log in with the credentials: admin/finjan (For V11.5 and later the default password is TrustwaveSWG).

6. Run the setup command and provide networking information (this will probably be identical to the previous system that was deleted).

7. Log into the Policy Server GUI and add the new VM scanner to the devices tree.

8. Click Save and commit the changes.

How do I image an SWG with a USB Key?

ofer Kalef — Sun, 24 Nov 2013 01:59:47 GMT

Software Version

10.x, 11.0

Question

How do I image an SWG with a USB key?

Answer: Follow the steps to create a bootable USB key that will re-image an IBM appliance:

1. On the Trustwave support webpage https://support.levelblue.com/, go to Home > Support > Support by Product > Secure Web Gateway.

2. Download the "USB Key Creator" as well as the "USB Key Creator – Technical Brief" relevant to your SWG version. Follow the instructions for creating a USB key provided in "USB Key Creator – Technical Brief".

After booting from the USB key, you should see following screen (depending on the version):

3. Follow the on-screen instructions for SWG installation.

4. After installation is complete, connect to the SWG using ssh and run the setup command to complete post-installation configuration.

Upgrade SWG OS from 10.1.x to 10.2 with database migration

ofer Kalef — Sun, 24 Nov 2013 01:56:44 GMT

This article applies to:

SWG 10.1.2
SWG 10.1.3

Question:

What is the procedure to upgrade SWG OS 10.1.x server to SWG OS 10.2?

Procedure:

The following are required:

SWG OS 10.2 ISO image
VSI 1.6.0.13 upgrade/installation utility
Bootable USB drive containing the above files

Refer to the Trustwave Customer portal to download these files and detailed instructions on how to create a bootable USB drive.

1. Connect a VGA monitor and keyboard to the SWG server, and make sure it is set to boot from the USB drive.
2. Reboot the server. The following menu should display:

3. Choose option 4, Installation and Upgrade menu from v10.1.0 to v10.2.0

At this point, the USB drive will load all the files required to perform the upgrade.
Shortly after, the upgrade utility wizard will ask which version you require for the installation.

If the device you are trying to upgrade has been upgraded before, there may be additional lines in this menu.
In most cases, it will have two options:

1010-b12 - for the currently running SWG OS 10.1.x
1020-b26 - for a new SWG OS 10.2 image

4. Choose the appropriate option for the SWG OS 10.2 version. The following screen should display asking for the configuration to restore:

As previously, the upgrade wizard gives an option to perform a clean installation or a database migration from a previous SWG DB configuration.
5. Since we want to keep the existing 10.1.x configuration intact, choose the 10.1.x corresponding option, and not Clean Installation.

Immediately after, the following "Running database migration" screen should display.
Depending on the volume of data being upgraded, this step may take longer for some SWG upgrades.

After the database migration is complete, the wizard proceeds with the installation. The system will reboot once.

6. On reboot, make sure that the SWG server is booting from the hard drive, and not from the USB drive.

7. Allow the system to complete all internal modules and expect to see a prompt to log into the limited shell interface.

8. After the upgrade is complete, you can log into the GUI to apply the latest security updates available for SWG OS 10.2.

Notes:

If the SWG Policy Server manages one or more dedicated scanners attached to it, these devices will need to be upgraded separately.

This can be accomplished in two ways:

A clean installation of the SWG OS 10.2 image - the setup wizard would have to be run before the scanner can be added back to the Policy Server
Upgrading the scanner from the Policy Server, using the config_upgrade command in the limited shell interface of the Policy Server running SWG OS 10.2

How to backup SWG

ofer Kalef — Tue, 24 Sep 2013 08:31:31 GMT

This article applies to:

SWG 10.x
SWG 11.x

Question:
How do I create a backup of my SWG settings and configuration?

Procedure:
There is a feature in SWG called "Backup" (or "Rollback" in SWG version 10.x.) This feature allows you to create a backup file of your SWG where it can be saved in an alternate location (backups are not saved locally on the SWG). A backup consists of all data that an administrator can customize in the Management Console (including Policies, Settings etc.).

To create a rollback:

In SWG 10.x, navigate to Administration > Rollback > Rollback Settings

In SWG 11.x, navigate to Administration > Policy Server DB Backup > Backup Settings

From here you can configure a connection method location and scheduling for the backup. If you have any trouble in configuring the backup, click the "?" or F1 Help button to see additional information about backup settings.

Why is backup helpful? In the event of a critical system failure where the SWG is not recoverable, the SWG system can be re-imaged to its default factory settings. After it has been reset to its factory settings, the last saved backup can be applied to the system restoring the custom configuration and settings.

Note:
System backups do not include information in the LogServer database, Reports Server database (see Administration > Reports DB Backup > Backup Settings), Custom Block Messages, and Updates.

Windows 7 SWG USB Drive Bootable creator

ofer Kalef — Sun, 08 Sep 2013 07:13:26 GMT

This article applies to:

SWG 10.x
SWG 11.x (for clean installation)

The following information will help guide you in creating a USB key that can be used to upgrade a SWG physical appliance.

Installation tool:

This tool allows creation of a USB bootable drive for version upgrading/fresh install for the Trustwave Security SWG.

To create a USB key:

Download and run the M86USB.EXE (see below for download location/s)
Format the USB flash drive as FAT32
Run the M86USB.EXE tool, choose the drive letter for the USB flash drive and click OK
Download and copy the version ISO file to the USB flash drive
Download and extract the VSI (VS Installer) to the USB flash drive - make sure you are extracting the files and not a TGZ/TAR/ZIP file (if TGZ/TAR/ZIP extract it's contents to the USB flash drive)

M86USB Version 2.1 January 2011 - FTP download location:
ftp://Outgoing:Mr8om21r@swgftp.trustwave.com/support/M86USB/M86USB.EXE

Usage video – download location:
ftp://Outgoing:Mr8om21r@swgftp.trustwave.com/support/M86USB/M86USBTOOL.avi

For proper VSI and ISO please visit:

https://support.levelblue.com/Secure-Web-Gateway/Upgrade.asp

Note: this method can be used for upgrades from 9.x to 10.2.

No updates for Virtual SWG system

ofer Kalef — Sun, 08 Sep 2013 07:05:56 GMT

This article applies to:

Virtual SWG 10.x
Virtual SWG 11.x

Symptoms:

Updates are not installed, and no new updates are shown as available when attempting to retrieve manually.
System Log shows an error on connecting with the Updates server.

Causes:

This may happen due to the default date/time settings used for a Virtual installation - check the current date/time set on SWG to verify.

Resolution:

Update the date/time settings using the config_time Limited Shell command. The best update method is to specify an NTP server, public or local.

What are the physical properties of all SWG models

Rudolf Kessler — Mon, 17 Sep 2012 05:26:39 GMT

This article applies to:

SWG 10.x, 11.x

Question:

We'd like to put hardware graphics into our server-room-management-system.

Is it possible to get a document which includes IBM Model, Size, Power Consumption, Numbers of Power supplies? This information is necessary to plan the racks in our datarooms.

Information:

See attachment

How do I use the Upstream Proxy Policy?

Rudolf Kessler — Fri, 22 Jun 2012 07:40:32 GMT

This article applies to:

Secure Web Gateway 10.x

Question:

Is it possible to use different upstream proxies based on conditions?
How do I use the upstream proxy policy?

Procedure:

In order to forward requests to different upstream proxies, basically three steps are necessary:

Define conditions
Create an upstream proxy "Object"
Assign this upstream proxy to the scanner(s)

The best practice is to perform the steps in the order that they are listed above. As an example, an administrator might want to use a specific upstream proxy for an individual URL. The administrator would follow the steps below.

1. Create a URL list accordingly:

2. Create a "Upstream Proxy Object":

2.1 Policies > Condition Settings > Upstream Proxy

2.2 In order to add a Upstream Proxy, right click [Upstream Proxy]:

2.3 Define your Upstream Proxy details (IP address, ports, ...):

3. Create the Upstream Proxy policy and assign it to the Scanner(s)

3.1 Under Policies > Upstream Proxy, add a Policy:

3.2 Add a rule to this policy, in order to use the condition(s) defined in step 1:

3.3 Add the condition(s)

3.4 As a last step, assign this Upstream Policy to your scanner(s); the new Upstream Proxy policy can now be found in a dropdown-list in "Scanner Device Policies":

Notes:

Upstream Proxy policies can be defined "per scanner", providing the ability to distinguish between local and cloud scanners!
Security Policies are evaluated regardless of Upstream Proxy Policies; according to your requirements it might be necessary to whitelist client requests accordingly before they are sent to the upstream proxy!
Of course other conditions, such as header fields or IP range can be used.
One Upstream Proxy Policy can point to more than one upstream proxy. This does not automatically include Backup Upstream Proxy functionality.
Important for troubleshooting: When caching is enabled the scanner process connects to the caching server (upstream) and the caching server connects to the "real" configured upstream server. So when looking at traffic captures or logs, this behavior will be seen in the logs/cap files.

How to reset a SWG7000 Advanced Management Module

Rudolf Kessler — Fri, 22 Jun 2012 06:39:27 GMT

This article applies to:

SWG 7000
AMM (Advanced Management Module)

Question:

How can I reset the settings of an AMM?

Procedure:

The management module reset button is shown in the following figure.

Use a straightened paper clip or similar item to access it. The reset button has two uses:

Reset the network configuration: Press and hold the reset button for 3 seconds or less.
Reset the entire management module (including user IDs and passwords) to the factory defaults. This requires a sequence of presses and releases:
- Press and hold the reset button for 5 seconds.
- Release the button and wait 5 seconds.
- Press and hold the button for another 10 seconds.
Note that this sequence should be as precise as possible to ensure success: 5 in, 5 out, 10 in. After you do a full factory defaults reset in this way, the default user ID and password will be in effect: USERID (all caps) and PASSW0RD (a zero, not the letter O).

After the network configuration has been reset, you can access the Web interface to reconfigure it. To do this, you will need to know the management module's IP address. This can be done as follows:

The management module defaults to using DHCP. The host name will be MMxxxxxxx, where xxxxxxx is the MAC address of the management module. This number is printed below the reset button.
If no DHCP server is found, the management module uses a default IP address of 192.168.70.125 with subnet mask 255.255.255.0. The host name will be MMxxxxxxx.

Notes:

Because it is possible to reset the passwords using the reset button, you should ensure that your BladeCenter chassis is physically secure so that only authorized personnel can physically access the reset button.

Source: IBM @ http://www.redbooks.ibm.com/abstracts/tips0519.html

How to configure VMWare/SWG to let SWG be aware of cache kit installed

Rudolf Kessler — Fri, 22 Jun 2012 02:21:33 GMT

This article applies to:

SWG 10.x

Question:

Installed SWG on a VM and used a license key with caching enabled, but the policy server displays the following message:
"Current hardware does not support Cache. Therefore, enabling Cache will reduce system performance."
How should I configure VMWare/SWG to let SWG be aware of cache kit installed and stop displaying this message?

Procedure:

You need to add another hard drive to the virtual machine, 250G in size. Make sure that the virtual appliance has atleast 3G of ram configured.

The caching kit can be seen by running config_hardware command in limited shell

To add the additional HD:

For the VM you created select ‘Edit settings’ ->A dd… -> HardDisk -> Next -> create a new virtual disk -> next -> disk size=250G -> next -> next -> finish.

Now power off guest -> restart VM -> login to limited shell -> run config_hardware, select Y to configure it and wait for completion.

After the caching kit is configured via config_hardware, if you still see the message in the GUI 'Current hardware does not support caching...' in devices tab or if you cannot change the max object size, in caching tab, to over 16M, run the setup command again from the limited shell.

Now the message in the GUI 'Current hardware does not support caching...' should go away.

Caching Kit in SWG version 10.x

Rudolf Kessler — Fri, 15 Jun 2012 06:37:21 GMT

This article applies to:

SWG 10.x
Caching Kit

Question:

Do I have to do a clean re-install if a caching kit is retrofitted (as stated in the Caching Kit Tech Brief, article Q-13660)?
What is the procedure to install a Caching Kit?

Procedure:

With SWG version 10.0, a clean installation is no longer required.

Save your configuration by performing a 'Rollback Backup'. Power off the appliance (Limited shell command 'poweroff') and insert hard disk and RAM (if relevant). Then power up the appliance and login to the limited shell (SSH).

1. Run the command 'config_hardware'. It will show that the hardware is installed, but not yet configured.

2. The next step depends on appliance role:

2.1 On an All-in-one appliance, run the 'setup' command on the limited shell again. It should not be necessary to type all details again, simply confirm each step with [enter]. After setup is completed, some background processes are performed in order to update the configuration.

2.2 If a Scanning appliance (SWG x100) has been upgraded, login to the GUI, navigate to 'M86 Devices' and remove and add the scanner. Enable caching, if not done already.

related to step 2.1, after running the setup again:

Can I use my 9.2 license after upgrading to 10.2

Rudolf Kessler — Wed, 06 Jun 2012 07:11:15 GMT

This article applies to:

SWG 10.2,9.2

Question:

I want to upgrade from 9.2 to 10.2, but will my current 9.2 license be compatible to the 10.2 version?

Reply:

Yes, as long as your 10.2 SWG is not virtual and the AV and url filter engines you use are supported in 10.2 too.

High Availability Policy Server 9.0 - Technical Brief

Rudolf Kessler — Wed, 06 Jun 2012 03:53:02 GMT

This article was previously published as:: Finjan KB 1751

Cloud Scanner Platform Set-up Guide - Amazon EC2

Rudolf Kessler — Fri, 25 May 2012 08:47:45 GMT

This article applies to:

SWG 10.2
SWG Hybrid

Document:

This is a customer guide explaining how to configure the Amazon EC2 environment as a platform for an SWG Cloud Scanner. This is not for the Secure Web Service Hybrid (SWS-H).
(See attached document)

SWG Hybrid Deployment Guide

Rudolf Kessler — Fri, 25 May 2012 05:12:45 GMT

This article applies to:

SWG 10.2
SWG Hybrid

Document:

This guide explains how to approach an SWG Hybrid deployment including deployment decisions, deployment scenarios and configuration workflow.
(See attached document)

Mobile Security Client Administrators Guide

Rudolf Kessler — Fri, 25 May 2012 05:11:35 GMT

This article applies to:

SWG 10.2
SWG Hybrid

Document:

This guide will help systems administrators with the installation and operation of the M86 Security Mobile Security (MSC) Client software.
(See attached document)

How to add a new license to a SWG appliance

Rudolf Kessler — Thu, 24 May 2012 02:26:12 GMT

This article applies to:

SWG 9.x
SWG 10.x

Question:

How do i install a license in a new installed appliance or replace an existing one

Reply:

In order to install the license you will need to access the GUI at https://YourapplianceIPAddress

If this is a new installed appliance you will be prompted to change your password (default 'finjan') and receive this screen

Please enter the license:

Click on Continue

Tick "I accept" and click OK to accept the EULA

In order to check which components are licensed on the specific appliance click on Administration -->System Info

Notes:

Please note that replacing a license with different licensed components then the previous license installed on the appliance may cause downtime as the new components are reconfigured on the Policy server and also on the scanners and the latest updates are being installed.

Customer defined Security Policies will not be changed!

WCCP in 9.2 - Technical Brief

Rudolf Kessler — Thu, 24 May 2012 01:09:49 GMT

This article applies to:: NG 5000; NG 6000; NG 8000

This article was previously published as:

Finjan KB 1909

VMware installation: Can Host OS be Debian GNU/Linux 6 (64-bit)

Rudolf Kessler — Wed, 23 May 2012 07:33:44 GMT

This article applies to:

SWG 10.x

Question:

I'm re-installing a virtual SWG image and I'm now using a ESX5i server.

For the Host OS, can I choose "Debian GNU/Linux 6 (64-bit)" instead of "Debian GNU/Linux 4 (64-bit) " ?

Reply:

Yes.

Either one is good.

How to Reset the Admin Password

Rudolf Kessler — Wed, 23 May 2012 07:19:51 GMT

Description
The administrator password in software version 8.x/9.x/10.x needs to be reset.

Symptoms
Unable to login to the Setup Console (webmin) or to the limited shell as an admin user.

Cause
The admin password has been changed or forgotten.

Solution
In all supported software versions you can reset the admin password to the original password.
To perform this action:

Reboot the machine.
On an NG-1000 or NG-5000, please use the shutdown option available by pressing the down arrow button on the LCD panel.
After you have confirmed the shutdown twice by pressing the ENTER button on the LCD panel, please wait two minutes for the system to complete its soft shutdown prior to turning off the power switch on the back of the appliance.
On an NG-6000/SWG-3000 appliance, press and release the white power button to initiate the shutdown.
The unit will shut off when the soft shutdown is complete.
On an NG-8000/SWG-7000 blade, the restart can be performed from the management module.
Connect a USB keyboard and VGA monitor to the unit, and turn the unit back on.
On an NG-8000/SWG-7000 blade, the management module's remote control feature can be used instead.
Before the operating system loads, you might see a repeating message, saying "Press any key to continue".
Press a key (such as the spacebar) while the message is still repeating.

This will bring up the screen shown in the image below.
If the "Press any key to continue" message does not display, the screen shown in the photograph below should appear automatically.
Within a few seconds of the appearance of the screen shown below, use the down arrow key on your keyboard to highlight 'Reset Admin Password'. Press the Enter key on your keyboard to select this option. Doing so will reset the admin password to: finjan

Software Version
8.x
9.x
10.x

This article applies to:

This article was previously published as:: Finjan KB 1290

What is the SWG update server address?

Rudolf Kessler — Mon, 14 May 2012 02:24:49 GMT

This article applies to:

SWG 9.x
SWG 10.x

Question:

I want to restrict Policy Servers' requests, but updates should be allowed. What access do I have to permit through my Firewall?

Reply:

The required access is:

Destination Port 443 / HTTPS
Hosts [1] updateng.finjan.com and [2] mirror.updateng.finjan.com

Notes:

Trustwave strongly recommends that you use DNS. The IP addresses of these servers could change.