Marshal8e6 Knowledge Base

How do I move WebMarshal to a new server?

Charles Creegan — Fri, 03 Jul 2009 04:14:00 GMT

Abstract:

This article applies to:

WebMarshal 6.X

Question:

How do I move WebMarshal to a new server?

Procedure:

This article provides an overview of the steps required to move a WebMarshal 6.X installation to a new server.

The instructions below are for WebMarshal stand-alone single-server installations.

For some suggestions about Array installations, see the Notes below.
These instructions are NOT appropriate for any ISA installation.

To move WebMarshal to a new server and maintain your configuration (rules and settings):

On the new system, install the same WebMarshal release (such as 6.5.3.4444) that you have on the old system.

See instructions in the User Guide. Remember to set up virus scanner on-access exclusions.

Install any additional malware scanning software such as Sophos for Marshal.
Export the configuration from the old server and then import the configuration to the new server.

Q10222 - How do I back up my WebMarshal configuration?

If you have changed or want to change the temp folder or logging folder paths, edit the appropriate service XML files.
Verify that a full license key is installed. You may need to request a new key from Marshal8e6 using the Console (depending on the binding of the existing key).
Verify that imported user groups are populated. The contents of imported groups are NOT included in the configuration import.
If you are using database logging and the SQL Server location is changing, move the database.

Q102

Applying SpamProfiler cartridge version 3050 to a MailMarshal SMTP 6.5 installation

Charles Creegan — Wed, 01 Jul 2009 12:20:00 GMT

Abstract:

This article applies to:

MailMarshal SMTP 6.5
SpamProfiler

Question:

How can I apply SpamProfiler cartridge 3050 to a MailMarshal SMTP 6.5 installation?

Information:

SpamProfiler uses "cartridge" updates to apply updated processing logic and add new detection capabilities. This is distinct from the frequent signature updates that the cartridges retrieve.

Version 3050 of the SpamProfiler cartridge improves the spam detection rate and corrects a minor problem that can prevent signature updates in some environments. This cartridge will be provided automatically to all customers running MailMarshal SMTP version 6.4, and no intervention is required for customers running that version of MailMarshal SMTP.

MailMarshal SMTP version 6.5 has a known issue which prevents the safe automatic deployment of the cartridge. However, if the cartridge is manually deployed, it will work as expected. This cartridge deployment issue is currently scheduled to be fixed in the next version of MailMarshal SMTP.

MailMarshal 6.5 customers can apply the cartridge update manually using the following procedure:

On the Array Manager server, save the file linkd here: SpamProfiler.zip
Copy the file SpamProfiler.zip to the \Config folder within the MailMarshal SMTP installation.
From the Configurator, commit the MailMarshal SMTP configuration. The SpamProfiler cartridge will be deployed to all processing servers.

Once deployed, the new cartridge will begin downloading an initial set of signatures. While the signatures are being downloaded, depending on their Internet connection speed, customers can experience a period of about 20 minutes of low

How do I list applications using network ports?

Charles Creegan — Wed, 01 Jul 2009 05:57:00 GMT

Abstract:

This article applies to:

All Marshal products

Question:

How do I determine what port an application is using?
How do I determine what application is using a specific port?

Procedure:

Follow the steps below to determine if a network port is being used on a server, and the specific application using the port:

Open a command window
Type netstat -nb
The output displays all network connections establisned from the machine, the local and remote IP address and port in use, the process ID and the name of the executable that has established the connection.

Notes:

Use this method to determine if another proxy or SMTP listener is binding to ports required by Marshal products.

Error occurs when creating or connecting to a MailMarshal or WebMarshal database.

Charles Creegan — Wed, 01 Jul 2009 03:53:00 GMT

Abstract:

This article applies to:

MailMarshal SMTP
MailMarshal Exchange
WebMarshal
Marshal Reporting Console
Microsoft SQL Server

Symptoms:

Error occurs when creating or connecting to a MailMarshal or WebMarshal database.
Error: 'Login failed for user 'sa'. Reason: Not associated with a trusted SQL Server connection.'

Causes:

MailMarshal SMTP and MailMarshal Exchange cannot authenticate with the Microsoft SQL Server using Windows Authentication. The Microsoft SQL Server must be configured to use both SQL and Windows Authentication (Mixed Mode).

WebMarshal 6.0.2 and above can use either SQL or Windows Authentication.

Please note that Marshal Reporting Console requires SQL authentication. If you intend to use MRC with WebMarshal, you should configure Mixed Mode at the SQL Server.
Older WebMarshal versions require SQL authentication.

Information:

To address this issue, configure the Microsoft SQL Server or MSDE to use both SQL and Windows Authentication.

To configure MSDE:

Refer to the following Marshal Knowledge Base article for instructions on configuring MSDE to use SQL authentication:
Q10138 : Error: 'Login failed for user 'sa'. Reason : Not associated with a trusted SQL Server connection.'

To configure Microsoft SQL Server:

In SQL Server Enterprise Manager, right-click the required SQL Server.
Select the Security tab.
In

SpamProfiler not able to update with cartridge version 3050

Charles Creegan — Wed, 01 Jul 2009 03:01:00 GMT

Abstract:

This article applies to:

MailMarshal SMTP
SpamProfiler cartridge 3050 (June 2009)

Symptoms:

SpamProfiler updates failing

Causes:

With cartridge 3050, the default behavior of SpamProfiler is to contact the licensing server over HTTPS. Previous versions used HTTP for all communication.
If the server cannot be contacted over HTTPS, micro-updates or daily file updates can fail.

Resolution:

To resolve this issue you can do either of the following:

Ensure all the MailMarshal processing node servers can contact sigupdates.marshal.com on port 443 (SSL/HTTPS).
Alternatively, you can revert to HTTP for these connections.

Edit the file cartridge.cfg, found on each processing node server in the subfolder \SpamProfiler within the MailMarshal installation.
Add the line below to the bottom of the file:

enable ssl = no
From the Array Manager, commit the configuration. Restart the Receiver services on all nodes.

HTTPS Filtering and Block Pages

Giovanni Romualdi — Wed, 01 Jul 2009 01:33:00 GMT

Abstract:

This article applies to:

R3000 All Versions

Question:

Why don't I get a block page when I am trying to access a blocked https site?

Reply:

Because of the nature of https connections it's not possible to send a block page to the end user. What you'll see is an error message which will vary depending on the OS and the browser type.

Notes:

How come my ER can't get software updates?

Giovanni Romualdi — Wed, 01 Jul 2009 01:20:00 GMT

Abstract:

This article applies to:

ER SL or HL models v 5.0.00 or above

Question:

How come my ER can't get software updates?

Reply:

Your ER may have shipped with FTP updates enabled. That's incorrect becase all our products now only use HTTPS to receive updates. Please contact Tech Support to fix the problem.

Notes:

How come my ER can't get software updates? BACKEND FIX

Giovanni Romualdi — Wed, 01 Jul 2009 01:19:00 GMT

Abstract:

INTERNAL ONLY

Additional info for Q12863 How come my ER can't get software updates?

We need backend port 22 SSH access to fix this problem: Once logged in, edit file /usr/local/8e6/common/etc/erlibrary.conf , change LDC_UPDATE_HTTPS from off to on, save the file. Check the GUI for new patches after a few hours.

How do I edit an administrator account in the R3000?

Giovanni Romualdi — Wed, 01 Jul 2009 01:18:00 GMT

Abstract:

This article applies to:

All R3000 Versions

Question:

How do I edit an administrator account in the R3000?

Reply:

To change an administrator’s password and/or account
type:
1. Select the username from the Current User list box; this
action populates the Account Details frame with data.
2. In the Password field, enter eight to 20 characters for a
new password—including at least one alpha character,
one numeric character, and one special character. The
password is case sensitive.
3. Enter the same new password again in the Confirm
Password field.
If the administrator’s account type needs to be changed,
select the appropriate account type from the Type pulldown
menu (“Admin” for global administrator or “Sub
Admin” for NT/LDAP group administrator).
4. Click Modify to apply your settings.

Notes:

A username cannot be modified, but can be deleted and
added again.

How do I enter more than 250 characters in the Warn Page customization box?

Giovanni Romualdi — Wed, 01 Jul 2009 01:00:00 GMT

Abstract:

This article applies to:

R3000 v 2.0.10 or above

Question:

How do I enter more than 250 characters in the Warn Page customization box?

Procedure:

While the 250 characters limitation is hardcoded in the software, there's another way to add more text. Html code can be used in the box so if you are familiar with it, you can add a graphic that contains the additional verbage you want to use. Below is a screenshot and a code example used on one of our test units.

Notes:

How to check DMI event log

Giovanni Romualdi — Wed, 01 Jul 2009 00:58:00 GMT

Abstract:

This article applies to:

R3000 / ER / TAR SL or HL models

Question:

How do I check the DMI event log for any errors?

Procedure:

To view the DMI log, please use the following procedure.

1) Reboot the system, when the Supermicro logo is displayed press the delete key to go into the BIOS setup menu.

2) Using the arrow keys, move over to the right to highlight 'advanced' menu and press enter. See attached photo 'advanced_menu' for an example of this menu.

3) Using the arrow keys, move down to the 'DMI event log item', and press enter. See attached photo 'view_log' for an example of this menu.

4) Using the arrow keys, move down to the 'View DMI event log' choice, and press enter. A pop-up window will be displayed, if you are interested in any memory errors these would say something like ECC error or similar.

5) To exit from the BIOS setup, press the escape key 3 times, this will take you to the exit menu. Use the arrow keys to move down and select the 'exit without saving' choice, and press enter. A popup window will appear with the confirmation question "quit without saving?". Type a Y and press enter to confirm. The system will reboot.

Notes:

Optional.

How do I enter more than 250 characters in the Block Page customization box?

Giovanni Romualdi — Wed, 01 Jul 2009 00:45:00 GMT

Abstract:

This article applies to:

R3000 v 2.0.10 or above

Question:

How do I enter more than 250 characters in the Block Page customization box?

Procedure:

Notes:

Reboot causes removal of X Strikes-based lockout

Brian Tsu — Tue, 30 Jun 2009 18:53:00 GMT

Abstract:

This article applies to:

R3000 2.0 and up

Question:

Why are my X Strikes lockouts not preserved if the filter is rebooted?

Reply:

X Strikes lockouts are removed when the filter is rebooted because these lockouts are generated in response to events - namely, a user hitting too many Strike sites within the specified time frame. These lockouts are then simply added into the profile daemon, and not kept in an external list file or anything like that.

X Strikes are generally meant for temporary lockouts based on recent actions - if you want to create a more permanent lockout for a user or IP, it is generally better to do this via an individual IP or LDAP profile.

Notes:

X Strikes blocks users based on IP addresses and not usernames, so if a user is locked out and that user leaves the workstation, the workstation will remain locked for the next user unless the "Reset the X-Strike count upon authentication" option is enabled.

What is the error log (error.log) use for?

Thomas Pfau — Tue, 30 Jun 2009 18:37:00 GMT

Abstract:

This article applies to:

All R3000 Versions

Question:

What is the error log (error.log) use for?

Reply:

“Error Log (error.log)” - used only if an Alternate IP
Address is being used in the Block Page Route frame
of the Operation Mode window. This log only displays
information if the IP address used for sending block
pages is not being reconciled with the MAC address of
the NIC card.

What is the admin GUI sever log (AdminGUIServer.log) use for?

Thomas Pfau — Tue, 30 Jun 2009 18:36:00 GMT

Abstract:

This article applies to:

All R3000 Versions

Question:

What is the admin GUI sever log (AdminGUIServer.log) use for?

Reply:

How do I block inappropriate image searches?

Thomas Pfau — Tue, 30 Jun 2009 18:36:00 GMT

Abstract:

This article applies to:

R3000

Question:

How do I block inappropriate image searches?

Reply

The R3000 has the ability to force users to use Google/Bing/Yahoo/Ask/AOL "safe-search" modes when they conduct image searches, even if they try to disable safe-search locally in the search engines' options page. You can enable the "Google/Bing/Yahoo/Ask/AOL Safe Search Enforcement" feature in the Filtering Options in all profiles.

At this time, the R3000 cannot enforce safe-search mode for any other search engines, aside from Google/Bing/Yahoo/Ask/AOL . You can further enhance the safety of image searches by enabling URL Keyword Filter Control; again, available in the Filtering Options in all profiles. Once the option has been enabled, you can add URL keywords to any blocked category. By default, keyword lists are empty, so you must add your own list of keywords. If one of your keywords appears in the URL string, the user's request will get blocked.

This article was previously published as:: 8e6 KB 276579

Does the Apple 8e6 Authenticator support debug logging?

Thomas Pfau — Tue, 30 Jun 2009 18:35:00 GMT

Abstract:

This article applies to:

R3000
Apple 8e6 Authenticator

Question:

Does the Apple 8e6 Authenticator support debug logging, like the Windows version?

Reply:

Yes, the Apple 8e6 Authenticator actually has a medium level of debug logging enabled by default. The default location for the log file should be in your home directory, under /Library/Logs/8e6authenticator.log.

Notes:

The logging level can be modified by changing the LD[x] parameter in the 8e6Authenticator.conf file. The default level is 2, while the most verbose level is 4.

Using 8e6 R3000 filter in bandwidth throttling

Thomas Pfau — Tue, 30 Jun 2009 18:34:00 GMT

Abstract:

This article applies to:

R3000

Question:

Does the 8e6 filter do bandwidth throttling that would allow me to assign certain amount of kilobytes of bandwidths to a user for upload and download process.

Information:

The 8e6 filter does not do any form of bandwidth throttling because it only works off URLs and patterns.

Modifying date format on ER

Thomas Pfau — Tue, 30 Jun 2009 18:34:00 GMT

Abstract:

This article applies to:

ER -Enterprise Reporter

Question:

Can I modify the date format on the ER to reflect a British time as in yyyy-mm-dd rather than the US time of mm-dd-yyyy?

Information:

Currently you can not change the date format on the Enterprise reporter and any changes made to reflect the region that you are located would only affect the time format. That means if you change the time zone on the ER server GUI (see Fig. 1) the date format would remain the same but the time would reflect the region that you are located. It would not change how the date would be displayed, this applies to the filter as well.

Fig. 1

Synchronization during an upgrade

Thomas Pfau — Tue, 30 Jun 2009 18:33:00 GMT

Abstract:

This article applies to:

R3000

Question:

What happens to the Targets when the synchronization Source temporarily becomes unavailable during an upgrade?

Reply:

We recommend on patching the Targets first and then the Source. The Source will keep its settings and the Targets will continue to keep filtering based on their last good configuration, however, if your are using LDAP, then the Targets and Source (LDAP Profiles) will revert to the Global Group Profile until they are able to authenticate again.

How should NICs be connected for firewall mode?

Thomas Pfau — Tue, 30 Jun 2009 18:32:00 GMT

Abstract:

This article applies to:

R3000

Question:

How should NICs be connected for firewall mode?

Reply:

The general idea behind firewall mode is that traffic will flow into one interface and out the other (and thus the filter is in-line, or pass-through, with the traffic). As such, the interface that receives traffic from the internal network should be set as the listening interface, and the interface that transmits traffic towards the internet should be set as the block page device.

Notes:

In general, it is best if the two NICs are configured to use different subnets as well.

Emailing/Exporting a Report from the Enterprise Reporter

Thomas Pfau — Tue, 30 Jun 2009 18:31:00 GMT

Abstract:

This article applies to:

Enterprise Reporter
WebClient

Question:

Exporting a Report

Procedure:

The email option for exporting reports lets you electronically send the report in the specified file format to designated personnel.

. After running a Drill Down or a Custom Report click the Export button.

. Select Break type and Format.

1. Click the Settings topic in the navigation panel to open its menu and then click on User Groupings.

2. Select the user group from the Group Definations pull-down menu. Users set up for that group display in the list box in this frame.

3. Click the Disable Group button to exclude the user group from reports.

Notes:

Any user group that is currently disabled can be enabled for reporting.

How can I enable Wall Clock Time report

Thomas Pfau — Tue, 30 Jun 2009 18:30:00 GMT

Abstract:

This article applies to:

Enterprise Reporter

Question:

How can I enable Wall Clock Time report?

Description:

If Wall Clock Time is enabled, Wall Clock Time Reports can be generated by the administrator. These reports use the Wall Clock Time algorithm to calculate the amount of time an end user spent accessing a given page or object—disregarding the number of seconds from each hit and counting each unique minute of Web time as one minute. Using this algorithm, an end user could never have more than 24 hours of Web time within a given 24-hour period.

Procedure:

. Login to ER admin GUI (http://er-ip:88 or https://er-ip:8843)

. From the Database menu, select Optional Features.

. Click the radio button corresponding to “ON” to make the Wall Clock Time Report selection available in an administrator’s Custom Reports menu on Web Client.

. Click

NET USE login script

Thomas Pfau — Tue, 30 Jun 2009 18:30:00 GMT

Abstract:

This article applies to:

R3000

Question:

Tier 1 NET USE login script

Procedure:

The following syntax must be entered in the appropriate directory on the authentication server console:

The virtual IP address is used by the R3000 to communicate with all users who log on to that server. This address must be in the same subnet as the one used by the management interface of the R3000.

System http://domain.com
http://anotherdomain.com
http://members.domain.com
etc................

Wildcards look like this:

*.yahoo.com

*.myspace.com

2. For single urls, Do not add a url and reload every time, just apply action for each url, you can't mix wild cards and regular urls on one list.

3. I

Additional configuration to install Web Components on SBS2008

SPE Team — Mon, 29 Jun 2009 06:48:00 GMT

Abstract:

This article applies to:

MailMarshal SMTP 6.5 Web Components
Microsoft SBS 2008

Question:

What steps are required to install the Web Components on SBS2008?
Event log error message: The Module DLL C:\Windows\system32\RpcProxy\RpcProxy.dll failed to load. The data is the error.
Error message: Could not load file or assembly 'MMInterfaceVB' or one of its dependencies. An attempt was made to load a program with an incorrect format.

Procedure:

On SBS 2008, additional steps are required after installation of MailMarshal Web Components.

To enable Web Compnents:

Run the following command with elevated privileges:
%windir%\system32\inetsrv\appcmd.exe set config -section:system.webServer/httpCompression /-[name='xpress']

This command disables a compression module which is enabled by default on SBS 2008.
Open a text editor file with elevated privileges (for instance, from the Start menu right-click Notepad and select Run as Administrator).

In the file %windir%\system32\inetsrv\config\applicationhost.config:

change the line
<add name="PasswordExpiryModule" image="C:\Windows\system32\RpcProxy\RpcProxy.dll" />

to the following
<add name="PasswordExpiryModule" image="C:\Windows\system32\RpcProxy\RpcProxy.dll" preCondition="bitness64" />

How do I activate my Norman Virus Control antivirus?

Charles Creegan — Fri, 26 Jun 2009 06:01:00 GMT

Abstract:

This article applies to:

MailMarshal SMTP
MailMarshal Exchange
WebMarshal

Question:

How do I activate my Norman Virus Control antivirus?
How do I activate the Norman Virus Control license key?
How do I use the Normal Virus Control subscription I purchased from Marshal within MailMarshal?

Procedure:

If you have purchased a Norman Virus Control subscription from Marshal, you must activate your Norman Virus Control license key before you can use the product within MailMarshal.

To activate your Norman Virus Control license key:

Browse to http://www.norman.com/Support/auth/en.
Complete the registration form and enter your OEM code as provided by Marshal
You will recieve an e-mail message from Norman containing an authentication key. Enter this key as required in NVC configuration.

Notes:

This process is only valid if your Norman Virus Control was purchased from Marshal.

This article was previously published as:: NETIQKB46164

uninstalling the distributor when stuck in add in remove programs.

Thomas Pfau — Mon, 22 Jun 2009 19:45:00 GMT

Abstract:

This article applies to:

Mobile Client

Question:

What should I do if the Mobile Client distributor gets "stuck" in add/remove programs.

Procedure:

It's possible the installer is not able to detect that a version of the client is already running. check to see if "Inetcntrl.exe" is running in the Task Manager under 'processes'. If it is running, end-task on the process, delete the file 'Inetcntrl.exe' from "\%windows%\system32\Inetcntrl\" and reboot once more.

If that still does not correct it, it may be that the installer has become corrupted and you may need to use the Microsof Windows Installer Cleanup Utility (http://support.microsoft.com/kb/290301) to remove it from the Windows Installer. Once you remove it with this utility, you should also delete the files from \%windows%\system32\Inetcntrl\. Then rerun the Mobile Client installation .msi.

Where to check and see the process when running a report

Thomas Pfau — Mon, 22 Jun 2009 19:43:00 GMT

Abstract:

This article applies to:

Enterprise Reporter

Question:

When I run a report on the Enterprise Reporter where do I check to see the query that I am running or to know if it is still running?

Information:

To accomplish this you would need to open two browser connections to your ER web client. On the first GUI you can login and then start the report you needed (See Fig. 1). Then you open the second GUI on a different browser and then go to Settings>Process List (See Fig. 2) you should look in the “Command” column and look for the word “Query”, this tells you that your query is still running in the background. This process or query can also be killed/stopped from completion by clicking on “Kill” tab that corresponds to the query line. When the report has finished running you can click on the Process tab again to refresh the process list, and the “Query” line would no more be there as in Fig. 3

So Fig. 3 would be what you get before you start running your report and after you have finished running your report.

Reply:

You can open up another connection to the webclient in a second browser window and view the processlist. If there are entries in the processlist that have "localhost:xxxxx" (where xxxxx is some port number), then your report is still running. The port number here denotes that the process was initiated by an external source, i.e. your webclient request and not an internal automated processing command.

Method for Weighting Library Categories

Thomas Pfau — Mon, 22 Jun 2009 19:42:00 GMT

Abstract:

This article applies to:

All version of the R3000 filtering units.

Question:

How does the method of weighting categories works?

Procedure:

The order of operational precedence is: Always Allowed,

Blocked, and Pass.

In the event that an end user attempts to access a URL that

exists in multiple categories, the highest operational precedence

would be logged.

If a URL exists in a category that is Always Allowed, as well

as a category set to be Blocked for that user, Always

Allowed would be logged because it holds the highest operational

precedence.

However, if an end user attempts to access a URL set to be

Blocked in several categories, the category with the highest

weighting would be logged.

Notes:

If a URL exists in multiple un-weighted categories of the

same operational precedence, the category logged would be the

first one returned by the R3000 database. Since there is no

precedence given, the order in which the category is returned

would be random. While it is not necessary to weight all categories,

it is recommended that the categories considered a threat

should be weighted according to your organization's threat

assessment for each category

Intermediate Certificates

Thomas Pfau — Mon, 22 Jun 2009 19:42:00 GMT

Abstract:

This article applies to:

All R3000 filtering Units

Question:

What are the advantages of an intermediate certificate?

Information:

The first advantage of using intermediate certificates is enhanced security of the root certificate private key. If a root certificate is used to issue certificates on a daily basis then the corresponding private key of the root certificate must also loaded and available on the Certificate Authority Server(s) constantly. On the other hand, if instead an intermediate certificates is used to issue certificates on a daily basis then the private key of the root certificate can be removed from the CA Server and stored in off-line media that is not vulnerable to compromise by hackers. For this reason, most major CAs have adjusted their certificate structures so that the majority of their certificates are being issued using intermediate certificates.

The second advantage of using intermediate certificates is enhanced backward compatibility. For example, you may have heard of the new EV SSL certificates that are being offered by many of the Major CAs. EV certificates are issued in accordance with the highest SSL certificate standards available. All of these certificates are issued from new root certificates. Through the use of intermediate certificates, CAs are able to improve the compatibility of their EV certificates with older browsers through a process known as cross-signing. You will find that all EV certificates utilize intermediate certificates.

Notes:

Special thanks to Christopher Skarda for submitting this article

AD agent error: E_NwsktaWorkstationProbe_BadNetpath

Thomas Pfau — Mon, 22 Jun 2009 19:42:00 GMT

Abstract:

This article applies to:

AD Agent 1.0.3
AD Agent 1.0.2

Symptoms:

etscanWorkstationProbe Host error #53 in NetWkstaUserEnum
23 03:52:38.443 L NetscanWorkstationProbe NwkstaProbe
514 Error probing , error is E453 / E_NwsktaWorkstationProbe_BadNetpath

Causes:

“E_NwsktaWorkstationProbe_BadNetpath “ typically means the workstation is no longer online.

Resolution:

Notes:

Optional.

Is it possible to get a report of all the rules I''m blocking/allowing in a .pdf, excel, word document, from the R3000 GUI?

Thomas Pfau — Mon, 22 Jun 2009 19:41:00 GMT

Abstract:

This article applies to:

R3000 Enterprise Filter

Question:

Is it possible to get a report of all the rules I'm blocking/allowing in a .pdf, excel, word document, from the R3000 GUI?

Reply:

Unfortunatley the R3000 does now have this feature.

Notes:

If you would like for this feature to be available, please call Support, and ask for a feature request form.

What''s NNTP group news?

Thomas Pfau — Mon, 22 Jun 2009 19:41:00 GMT

Abstract:

This article applies to:

All versions of the R3000

Question:

I see an NNTP newgroup option under the library tab, what is it used for?

Reply:

The Network News Transfer Protocol or NNTP is an Internet application protocol used primarily for reading and posting Usenet articles as well as transferring news among news servers.

The NNTP Newsgroup window displays when NNTP Newsgroup is selected from the navigation panel. This window is used for adding or removing a newsgroup from the libraries.

Notes:

The well-known TCP port 119 is reserved for NNTP. When clients connect to a news server with SSL, TCP port 563 is used. This is sometimes referred to as NNTPS.

Placing warning on a site prior to accessing the site

Thomas Pfau — Mon, 22 Jun 2009 19:40:00 GMT

Abstract:

This article applies to:

R3000

Question:

How do I force a user to get a Warning on a site that they visited and can I place a warning on a site whose other category is set to Allow, ie (Allow & Warn)?

Information:

You can only place a Warn on a site that also exist in a Pass category or that is not categorized at all in the filter.

For example, if you have the site www.site.com existing in the General Business library category and it is also existing in your custom category for example called TrueTest, and the General Business category is set to “Allow” while your custom category (TrueTest) is set to “Warn” you would not be able to get the warn page because of the filtering precedence of “Allow” having higher priority. So you would want to make sure that the General Business category is set to “Pass” and the your custom category (TrueTest) or any other category that the site exist in is set to "Warn".

Reply:

By default, upon successfully logging into the Web Client interface will display canned reports for *yesterday’s* data showing either the Top 20 Users by Blocked Request or Top 20 (Internet Filtering). If the ER Server does not contain any data—as on a newly installed unit—the default report page will not show any thumbnail images or bar chart report in the panel, instead the following text displays: “This report cannot be displayed because there is no data to show for this report.”

How to setup Real Time Probe login accounts.

Thomas Pfau — Mon, 22 Jun 2009 19:38:00 GMT

Abstract:

This article applies to:

R3000
R3000IR

Question:

How to setup Real Time Probe login accounts.
Can non-admin users be allowed to run Real Time probes?

Procedure:

Real Time Probe Logon Accounts can be used to define GUI accounts that have the ability to run Real Time Probes. These account can only be used at the RtProbe.html login screen and not the normal R3000 Administrator GUI login.

You can setup the Real Time Probe login accounts under the Reporting tab > Real Time Probes > Logon Accounts. You have to define and configure all the accounts manually. Only the accounts listed under "Current Accessible Users" will be allow to login.

To use the login account, users will have to go to the following URL:

http://<R3000_IP>:88/R3000/RtProbe.html

(NOTE: Again, this account will not work in the normal GUI login prompt)

Upon login, the only thing that comes up is the Real Time Probes Report GUI, with the View and Create tabs.

What items are synchronize when I select all?

Thomas Pfau — Mon, 22 Jun 2009 19:37:00 GMT

Abstract:

This article applies to:

All R3000 Filters

Question:

When I synchronize all items, what items are actully been sync?

Reply:

Synchronize All Items
The following lists show which items will be synchronized when the option to synchronize all items is selected.

Synchronized Items (All):
• 8e6 Library additions/deletions
• Custom library creations
• Custom library additions/deletions
• Search Engine keyword additions/deletions
• Keywords in URL additions/deletions

Functionally Synchronized Items (All):
• Common Customization, Block Page Authentication settings, Authentication Form Customization, Lock Page Customization, Warn Page Customization, Profile Control settings, Quota Block Page Customization, Quota Notice Page Customization
• Minimum Filtering Level
• Rules
• Global Group Profile
• Override Account: addition/deletion, activation/deactivation
• Lock Profiles
• IP User/Group and sub-group: additions/deletions, changes, filter changes
• NT/LDAP User/Group: additions/deletions, changes, filter changes, profile activation/deactivation
• Category Weight System additions/deletions
• Quota Setting

Non-synchronized Items (All):
• Filter control settings
• Virtual IP and Authentication IP addresses
• IP addresses
• Default routes
• Patch application
• Synchronization settings
• Filter Mode
• NIC Configuration
• Backup/Restore
• Radius Authentication Settings
• SNMP configuration
• X Strikes Blocking settings
• Warn Option Setting
• Reporter configuration
• CMC Management

Notes:

How do I schedule a saved report to run?

Thomas Pfau — Mon, 22 Jun 2009 19:37:00 GMT

Abstract:

This article applies to:

Enterprise Reporter
Product 2.x

Question:

How do I schedule a saved report to run?

Reply:

Once a report view has been saved, it can be scheduled to run at a designated time.

To schedule a report to run:

1. Go to the Settings menu in the navigation panel and select Event Schedule.

2. In the Event Schedules window, click Add Event.

3. In the Add Event to Schedule pop-up box, select the Report to Run from the saved custom reports listed in the pull-down menu.

4. Specify criteria for scheduling the event, and then click Save

Notes:

What is the calculator used for in IP groups or range to dectect?

Thomas Pfau — Mon, 22 Jun 2009 19:36:00 GMT

Abstract:

This article applies to:

All R3000 versions

Question:

What is the calculator use for?

Reply:

The Calculator button displays on windows in which IP ranges are entered. These windows include: Block Page Route Table window from the System section, and Range to Detect and Members windows from the Group section.

This window is used to view and/or calculate the minimum and maximum range for an IP address.

1. Click Calculator to open the IP Calculator pop-up window.

• If the IP address field in the window on the console is already populated, note the IP Calculator pop-up window displays the IP address, default Netmask in both the Dotted Decimals Notation (e.g. “255.255.255.248”) and CIDR Notation (e.g. “29”) format, Min Host, and Max Host IP addresses.

• If the IP address field in the window on the console is empty, in this pop-up window enter the IP address, specify the Dotted Decimals Notation Netmask, and then click Calculate to display the Min Host and Max Host IP addresses.

Notes:

If necessary, make a different IP address entry and Netmask selection, and then click Calculate to display different Min Host and Max Host results.

Why is there a delay in synchronization?

Thomas Pfau — Mon, 22 Jun 2009 19:36:00 GMT

Abstract:

This article applies to:

All R3000 version

Question:

Why is there a dellay in the synchronization?

Reply:

Delays in Synchronization:

When a filtering profile is applied to the source server, there is a slight delay in the time it takes to apply the profile to the target server. This delay is caused by the amount of time it takes the source server to process the change, prepare the update for submission, send the update, and finally to activate the update on the target server. In practice, this should only be matter of seconds. In essence, filtering profiles are shared in near real time with this factor being the only delay.

The delay in activating a library change can take a little longer than in activating a filtering profile change. This is due to the fact that the library on the R3000 is loaded into the physical memory. When a change is made to the library, a new library must be loaded into memory with the changes. So the delay between the library change taking place is the net of the amount of time it takes the source server to prepare the update for submission, and then the amount of time it takes for the update to be sent, received, and processed by the target server. Once processed, the new library is loaded into memory and activated, while the old version of the library is removed from memory. The total time of this process will vary depending upon custom library entries, but the entire procedure should take approximately one minute.

Notes:

Load-balancing options: Persistence vs. LeastConnections

Thomas Pfau — Mon, 22 Jun 2009 19:35:00 GMT

Abstract:

This article applies to:

R3000 (all versions)

Question:

We are thinking of putting our R3000s behind a load-balancer. There are a couple of different ways to set up the load balancer in regard to how to choose which filter to send traffic to, based on several parameters. Two of the parameters I'm concerned about are Persistence and LeastConnections. Which is best?

Reply:

First, let's define the two options.

Persistence : Keeps each connection to the same R3000 throughout the entire conversation. For example, if you were to go to CNN.com, all of your requests and replies would go to the same R3000.

LeastConnections : Distributes the connections to the R3000 with the least amount of current connections throughout the conversation. For example, if you were to go to CNN.com, all of your requests and replies would be distributed to multiple R3000s.

Which works best with the Marshal8e6 R3000?

You should consider using LeastConnections. LeastConnections will offer the best balance across all devices. Because the R3000 inspects traffic at the packet level, splitting a single conversation across multiple R3000's does not impact performance.

Persistence can offer one benefit of easier troubleshooting, if the entire conversation stays with a single R3000. However, most browsers these days will use several TCP sessions to load a single page, so you will not realistically gain much benefit from this, anyway.

Initial lag when mobile client displays first block page

Thomas Pfau — Mon, 22 Jun 2009 19:35:00 GMT

Abstract:

This article applies to:

Mobile Client (all versions)

Question:

Why is there an initial lag when the mobile client displays the first block page?

Reply:

The "Access Denied" page is generated by the Mobile R3000's built-in Apache web server. When you first start your laptop computer and go to a site that's blocked, the mobile client itself displays a temporary place holder (white page) while it negotiates the initial block page with the Mobile R3000. Depending on the speed of your Internet connection, you may not even notice this temporary place holder, and just see the block page.

Need to re-install mobile client after resetting Winsock catalog?

Thomas Pfau — Mon, 22 Jun 2009 19:34:00 GMT

Abstract:

This article applies to:

Mobile Client (for Windows)

Question:

I reset the Winsock catalog on my PC, and now the mobile client doesn't work right. Do I need to re-install the mobile client?

Reply

Yes, you will have to re-install the mobile client if you reset the Winsock catalog on your Windows computer.

Notes:

Optional.

How do I reset the Winsock catalog on my PC?

Thomas Pfau — Mon, 22 Jun 2009 19:34:00 GMT

Abstract:

This article applies to:

Mobile Client (for Windows)

Question:

I'm having problems with my mobile client, and I would like to reset my Winsock catalog to see if it's corrupted.

Reply:

1. Un-install the mobile client (if installed)

2. Click on Start -> Run, and enter this command to reset the Winsock catalog:

netsh winsock reset catalog

3. Install the mobile client

Notes:

Optional.

How to configure WhatsUp Gold to use SNMP v2c

Thomas Pfau — Mon, 22 Jun 2009 19:33:00 GMT

Abstract:

This article applies to:

R3000
ER
TAR

Question:

How do I configure WhatsUp Gold to use SNMP v2c?

Procedure:

The R3000, ER, and TAR appliances are compatible with SNMP v2c. (Version 1 is no longer supported).

You must specify "SNMPv2c" when you CREATE a new SNMP credential. You cannot go back and edit an existing credential. So, go into the Credentials Library and create a NEW SNMP credential, specifying "SNMPv2c" as the type.

Notes:

Optional.