SRX

Working with a customer that is looking to implement Websense on a 1400 or larger unit. UTM is of course not supported. It appears that the only way to do this is via redirect using firewall filters (FBF)  - 

Wondering if any of my fellow community members have done this and have any feedback on how well (or not well) this works. Any comments are appreciated.

I have done this on SRX-3600 and the Websense V10K appliance.  Its the same procedure if you were to do the redirect using an EX switch.

The only issue is that its easy to blackhole hole your traffic if your Websense appliance dies since your FBF will keep forwarding traffic to the dead Websense box.

If possible its probably better to do this using PAC files and let the hosts redirect the traffic.

Thanks for the reply. One other follow up question. Did you have to disable tcp-syn-check? JTAC said that this must be done which is just not acceptable. 

Thanks!

I have tried this in the lab. But I have redirected the traffic to a branch box which was running web-filtering. Worked fine using FBF. Just be careful with what you forwarding and the way you are receiving the traffic from the branch box. Make sure the 1400 doesn't drop the traffic based on the re-route failure.