Configure second NIC for Promiscuous mode in Windows 2003 4

[Dfig]

We use Websense for content filtering. I want to configure the second NIC on my Websense Server to Promiscuous mode so I can look at all the traffic (after configuring a Spanning port on my switch) but I don't know where to set that. Can someone point me in the right direction? I am running Windows 2003 R2 SP2 on my Server.

 

[tfg13]

Does Websense come with WinPcap? If not, the libraries of WinPcap will need to be loaded:

http://www.winpcap.org/default.htm

What do you plan to use to look at all the traffic?

 

[58sniper]

Are you sure traffic goes THROUGH Websense? The firewall queries the desired site against the WebSense list and then sends the user either to the site or the block page. I think just the query traffic goes to Websense.

I'm assuming, of course, that you're using it with a Cisco firewall that is setup that way.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[Dfig]

As it is set up now, there is a statement in the firewall to verify all port 80 traffic with Websense which is . I want to be able to filter certain protocols (such as IM). I was told by my Websense reseller that I would have to configure my second NIC(In Promiscuous mode) to plug into a configured Span port on the same switch that my Firewall is plugged into (Pix 515) and then go into my Websense management console and configure the network agent. The reseller told me that when I was ready for this I can call him to walk me through it.

 

[baddos]

What make/model switch do you have?

 

[Dfig]

I have a Cisco 2950.

 

[baddos]

Ok, that's simple enough.

If the firewall and the websense server are on the same switch that configuration would be something like this:

interface FastEthernet0/1
    description Websense Server
    port monitor FastEtherenet0/2 !assuming fa0/2 is the firewall

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml

 

[Dfig]

OK, the port spanning setup seems easy and as far as Websense we are running version 6.3 I don't know if Wincap is part of it but I'll check. Now I just need to know how to configure my second NIC.

 

[tfg13]

If you are going to be "sniffing" with that NIC, just set it up to obtain it's IP automatically. With WinPcap loaded, and the port spanned, this should be the setup you need.

 

[Dfig]

That's great. Thank you all for your valuable posts.

 

[Helenp1983]

I didn't load WinPcap, i set the NIC in Promiscuous mode by removing the Internet protocol from the NIC properties.

I am using websense 6.3, and a netgear switch, the soruce port plugs to the core switch - LAN traffic comes from

the monitoring/sniffer port and is plugged into the monitor second NIC on the websense box.

Then the first NIC on the websense box (configured with an IP) goes into the same switch on a standard port, for blocking and normal server communication.

my two firewalls are also plugged into standard ports on the same switch

http://www.websense.com/SupportPortal/Tutorials/1547.aspx

http://www.websense.com/SupportPortal/1204.aspx

 

[Dfig]

baddos, the spanning port config you gave me is for a 2900.
The 2950 is a little different.
switch(config)#monitor session 1 detination interface
fastethernet 1
switch(config)#monitor session 1 source interface
fastethernet 2

Thanks Helenp1983. This is what I was looking for....