installation guide network appliance™ netcache

242 Pages·2006·3.17 MB·English

INSTALLATION GUIDE
for use with
NETWORK APPLIANCE™ NETCACHE®
Websense Enterprise®
Websense® Web Security Suite™
-including Corporate Edition
v6.2
©1996–2006, Websense, Inc.
10240 Sorrento Valley Rd., San Diego, CA 92121, USA
All rights reserved.
Published April 10, 2006
Printed in the United States of America and Ireland
The products and/or methods of use described in this document are covered by U.S. Patent Numbers 6,606,659 and 6,947,985
and other patents pending.
NP33-0003NTC
This document may not, in whole or in part, be copied, photocopied, reproduced, translated, or reduced to any electronic
medium or machine-readable form without prior consent in writing from Websense, Inc.
Every effort has been made to ensure the accuracy of this manual. However, Websense, Inc., makes no warranties with
respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose.
Websense, Inc., shall not be liable for any error or for incidental or consequential damages in connection with the furnishing,
performance, or use of this manual or the examples herein. The information in this documentation is subject to change
without notice.
Trademarks
Websense and Websense Enterprise are registered trademarks of Websense, Inc. in the United States and certain international
markets. Websense has numerous other unregistered trademarks in the United States and internationally. All other
trademarks are the property of their respective owners.
Network Appliance is a trademark and NetCache is a registered trademark of Network Appliance, Inc., in the U.S. and other
countries.
Microsoft, Windows, Windows NT, Windows Server, and Active Directory are either registered trademarks or trademarks
of Microsoft Corporation in the United States and/or other countries.
Sun, Solaris, UltraSPARC, Sun Java System, and all Sun Java System based trademarks and logos are trademarks or
registered trademarks of Sun Microsystems, Inc., in the United States and other countries.
Red Hat is a registered trademark of Red Hat, Inc., in the United States and other countries. Linux is a trademark of Linus
Torvalds in the United States and other countries.
Novell, Novell Directory Services, eDirectory, and ZENworks are trademarks or registered trademarks of Novell, Inc., in
the United States and other countries.
Netscape and Netscape Navigator are registered trademarks of Netscape Communications Corporation in the U.S. and other
countries.
UNIX is a registered trademark of The Open Group in the United States and other countries.
This product includes software developed by the Apache Software Foundation (http://www.apache.org).
Copyright (c) 2000 The Apache Software Foundation. All rights reserved.
Other product names mentioned in this manual may be trademarks or registered trademarks of their respective companies
and are the sole property of their respective manufacturers.
WinPcap
Copyright (c) 1999 - 2006 NetGroup, Politecnico di Torino (Italy).
Copyright (c) 2006 CACE Technologies, Davis (California).
All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following
conditions are met:
• Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
• Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following
disclaimer in the documentation and/or other materials provided with the distribution.
• Neither the name of the Politecnico di Torino, CACE Technologies nor the names of its contributors may be used to endorse
or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Contents
Chapter 1 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9
About this Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9
Websense Enterprise Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
How Websense Works. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12
Deployment Tasks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
Chapter 2 Network Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
Websense Enterprise Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
Websense Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22
Switched Environments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
NAT and Network Agent Deployment . . . . . . . . . . . . . . . . . . . . . . .27
Directory Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27
System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29
Supported NetCache Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29
User Workstations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30
External Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30
Chapter 3 Upgrading Websense Enterprise . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31
Versions Supported . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32
Transferring Configuration Data Without Upgrading. . . . . . . . . . . . . . .32
Before You Upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33
Upgrading on Windows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35
Upgrading on Solaris or Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41
Upgrading the Remote Filtering Components. . . . . . . . . . . . . . . . . . . . .46
Remote Filtering Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .46
Remote Filtering Client Pack. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .47
Remote Filtering Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .47
Manual Upgrade of Remote Filtering Client . . . . . . . . . . . . . . . .48
Network Appliance NetCache (cid:88) 3
Contents
Upgrading Remote Filtering Client with a Third-Party
Deployment Tool. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Converting a Stand-Alone System to an Integrated System . . . . . . . . . 51
All Components on the Same Machine. . . . . . . . . . . . . . . . . . . . . . . 51
Distributed Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Upgrading to the New Stand-Alone Edition. . . . . . . . . . . . . . . . . . . 53
Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Solaris or Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Converting to an Integrated System . . . . . . . . . . . . . . . . . . . . . . . . . 63
Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Solaris or Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Changing IP Addresses of Installed Components . . . . . . . . . . . . . . . . . 67
Chapter 4 Installing Websense Enterprise. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Before Installing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Typical Websense Enterprise Installation . . . . . . . . . . . . . . . . . . . . . . . 71
Windows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Solaris or Linux. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Installing Websense Enterprise Components Separately. . . . . . . . . . . . 96
Windows Procedures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Websense Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Network Agent. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
DC Agent. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Real-Time Analyzer (RTA). . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Usage Monitor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
RADIUS Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
eDirectory Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Logon Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
Remote Filtering Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Remote Filtering Client Pack. . . . . . . . . . . . . . . . . . . . . . . . . . . 126
Remote Filtering Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Solaris and Linux Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Websense Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
Network Agent. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
Usage Monitor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
RADIUS Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
eDirectory Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
4 (cid:87) Installation Guide
Contents
Logon Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .150
Remote Filtering Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .153
Modifying an Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .157
Adding Components. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .157
Windows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .158
Solaris or Linux. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .166
Removing Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .169
Windows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .169
Solaris or Linux. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .172
Repairing an Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .173
Windows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .173
Solaris or Linux. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .176
Repairing the Policy Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .178
Stopping or Starting Websense Services. . . . . . . . . . . . . . . . . . . . . . . .179
Manually Stopping Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .179
Optional Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .179
Principal Components. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .180
Windows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .180
Solaris and Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .181
Chapter 5 Initial Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .183
Subscription Key and Master Database Download. . . . . . . . . . . . . . . .184
Identifying the Filtering Service for the Block Page URL . . . . . . . . . .188
Displaying Protocol Block Messages . . . . . . . . . . . . . . . . . . . . . . . . . .189
Creating and Running the Script for Logon Agent . . . . . . . . . . . . . . . .190
Prerequisites for Running the Logon Script. . . . . . . . . . . . . . . . . . .190
File Location. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .190
Deployment Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191
Preparing the Logon Script. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191
Script Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191
Websense User Map and the Persistent Mode . . . . . . . . . . . . . .193
Examples. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .193
Configuring the Logon Script to Run. . . . . . . . . . . . . . . . . . . . . . . .194
Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .194
Windows NTLM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .196
Identifying the Proxy Server for the Network Agent . . . . . . . . . . . . . .197
Network Appliance NetCache (cid:88) 5
Contents
Configuring Network Agent to use Multiple NICs . . . . . . . . . . . . . . . 199
Testing Visibility of Internet Traffic to Network Agent . . . . . . . . . . . 200
Running the Websense Traffic Visibility Tool. . . . . . . . . . . . . . . . 200
Configuring Firewalls or Routers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
Firewall Configuration for Remote Filtering. . . . . . . . . . . . . . . . . . . . 203
Enabling communication between Remote Filtering Server and
Remote User Workstations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
Enabling communication between Remote Filtering Server and
Filtering Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
Chapter 6 Configuring NetCache. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
Configuring the NetCache Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
Configuring the Websense NetCache Service . . . . . . . . . . . . . . . . . . . 207
Upgrading from Websense Enterprise v.5.5 or Earlier. . . . . . . . . . 207
Multiple NetCache Appliances. . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
Logging Bytes Received. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
Logging Bytes Transferred using Network Agent. . . . . . . . . . . 211
Performance Tuning for Upgraded Versions. . . . . . . . . . . . . . . . . . . . 212
Appendix A Stealth Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
Configuring for Stealth Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
Windows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216
Solaris or Linux. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Solaris . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Appendix B Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
I made a mistake during installation. . . . . . . . . . . . . . . . . . . . . . . . . . . 220
I forgot my Websense Policy Server password . . . . . . . . . . . . . . . . . . 220
Where can I find download and error messages?. . . . . . . . . . . . . . . . . 220
Windows 2000 and 2003. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
Solaris and Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
The Master Database does not download. . . . . . . . . . . . . . . . . . . . . . . 221
Subscription Key. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
Internet Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
Restriction Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222
6 (cid:87) Installation Guide
Contents
Policy Server fails to install. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .222
I upgraded Websense, and configured users no longer appear
under Directory Objects in Websense Manager . . . . . . . . . . . . . . . . . .223
Network Agent fails to start with stealth mode NIC. . . . . . . . . . . . . . .223
IP address removed from Linux configuration file . . . . . . . . . . . . .223
Stealth mode NIC selected for Websense communications
in Solaris and Linux. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .224
Network Agent is not filtering or logging accurately . . . . . . . . . . . . . .224
Windows 9x workstations are not being filtered as expected. . . . . . . .224
Some users are receiving the Websense Global policy. . . . . . . . . . . . .224
Domain Controller Visibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .225
NetBIOS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .225
User Profile Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .226
Websense Enterprise splash screen is displayed, but installer
does not launch on Windows 2000 . . . . . . . . . . . . . . . . . . . . . . . . . . . .226
HTTPS requests are not being protocol blocked by Websense
when proxying to NetCache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .227
Internet requests are not being filtered . . . . . . . . . . . . . . . . . . . . . . . . .228
Network Agent cannot communicate with Filtering Service
after it has been reinstalled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .228
Appendix C Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .231
Websense Technical Services Support Center . . . . . . . . . . . . . . . . . . .231
Premium Support. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .231
Support Options. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .232
Web Portal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .232
Email Questions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .232
Telephone Assistance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .232
Customer Care. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .233
Improving Documentation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .233
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .235
Network Appliance NetCache (cid:88) 7
Contents
8 (cid:87) Installation Guide
CHAPTER 1 Introduction
Thank you for choosing Websense Enterprise®, the leading web filtering
system that integrates with Network Appliance™ NetCache®. Using
Websense in conjunction with NetCache provides you with a highly effective
internet filtering service.
Websense gives network administrators in business, education, government,
and other enterprises the ability to monitor and control network traffic to
internet sites. In the business setting, Websense Enterprise is an invaluable
tool for minimizing employee downtime due to internet surfing that is not
work related. In addition, Websense helps control the misuse of network
resources and the threat of potential legal action due to inappropriate access.
Websense, Inc. strongly recommends that your users be informed of your
organization’s policies concerning internet access, and that Websense
Enterprise has been installed as a tool for monitoring activity and/or enforcing
your internet use policies.
About this Guide
All installation procedures in this guide apply equally to Websense Enterprise
and Websense Enterprise – Corporate Edition. The same software is installed
for these two products, but the Corporate Edition feature set is enabled only if
you enter a Corporate Edition subscription key. For information about
Corporate Edition features, refer to the Websense Enterprise Administrator’s
Guide.
™
If you are installing Websense Web Security Suite , Websense Web Security
™
Suite – Lockdown Edition , Websense Web Security Suite – Corporate
Edition, or Websense Web Security Suite Lockdown – Corporate Edition,
read the Websense Web Security Suite Quick Start Guide first. The Quick Start
Guide contains the installation and setup instructions that are specific to the
Web Security Suite products and are not found in any other document. You
can download the Quick Start Guide from: http://www.websense.com/global/
en/SupportAndKB/ProductDocumentation. If you are installing Web
Network Appliance NetCache (cid:88) 9
Chapter 1: Introduction
Security Suite integrated with Network Appliance NetCache, the installation
and setup information provided in this installation guide is required to install the
Web Security Suite (web filtering) components of your Websense Web Security
Suite product. All references to “Websense Enterprise” may be read as
“Websense Enterprise and Websense Web Security Suite”.
Websense Enterprise Components
The following is a list of Websense Enterprise components. For detailed
information about each of these components, refer to the Websense Enterprise
Administrator’s Guide:
Filtering Service: interacts with NetCache to provide web filtering.
(cid:139)
Policy Server: stores all Websense Enterprise configuration information
(cid:139)
and communicates this data to other Websense services.
Websense Manager: administrative interface that allows you to
(cid:139)
configure and manage Websense functionality through the Policy Server.
Websense Manager is used to define and customize internet access
policies, add or remove clients, configure Policy Server, and much more.
User Service: allows you to apply filtering policies based on users,
(cid:139)
groups, domains, and organizational units.
Network Agent: detects HTTP network activity and instructs the
(cid:139)
Filtering Service to log this information. You must install the Network
Agent and configure it properly to use the Bandwidth Optimizer, Protocol
Management, and IM Attachment Manager features, and to log the
number of bytes transferred and duration of transfer. Network Agent is
also used as the filtering component for a stand-alone (non-integrated)
Websense system.
Usage Monitor: tracks users’ internet activity and sends alerts when
(cid:139)
configured threshold values are crossed.
DC Agent: an optional component that transparently identifies users who
(cid:139)
authenticate through a Windows® directory service. DC Agent enables
Websense to filter internet requests according to particular policies
assigned to users or groups.
RADIUS Agent: an optional component that works through a RADIUS
(cid:139)
Server to transparently identify users and groups who access your
network using a dial-up, Virtual Private Network (VPN), Digital
Subscriber Line (DSL), or other remote connections.
10 (cid:87) Installation Guide