Websense has recently been deployed as my site's web filtering solution. We're using port spanning to replicate the activity from 6 internal user VLANs to the Websense server. The WS server has dual NICs. One is dedicated to listening to all the traffic, and the other is used for the application's use (and administration). The product is working and restricted sites are being blocked. However, we are not seeing the "blocked page" HTML that should come with it.
Here's a quick breakdown of what is happening...
1. User enters the URL to a restricted site, and submits the page.
2. The request is sent out, and the activity is replicated to the Websense server via port spanning.
3. Websense recogizes the site as a restricted site, and issues a 302 reset.
4. The client browser returns a "Internet Explorer cannot display the webpage" message.
What is supposed to happen is there should be a webpage displayed (from the Websense server) that reads as "Your organization's Internet use policy restricts access to this web page at this time." Everything else is working, but this page never makes it to the client.
What I suspect is happening is...
1. The Websense server issues the 302 reset.
2. The Websense server then assumes the identity of the web destination, and responds to the client with the "... Internet use policy..." page. (By doing this... the user would still see thier original destination in the address line of thier browser... but the block page is coming from our internal server.)
3. This data is traveling out of the server... across my Cisco 3750 switch stack... and to my internal firewall (Netscreen SSG550).
4. Since the Websense server has "assumed the identify of the web destination"... I suspect that the NetScreen FW is seeing it as an IP Spoofing attack, and blocking the traffic at that point. I cannot be 100% sure that this is what is happening, but that is guess.
I have reviewed the Screening settings for the Zones on my NetScreen, and I do not see where any IP Spoofing protection is enabled. I was suspecting that this protection might be configurable by interface (or sub-interface), but I'm not sure where to confirm or deny that.
Any suggestions in reguards to the Websense product or the NetScreen firewall would be gratefully welcomed during pursuit of a resolution.
Thank you.
Start Free Trial
