Web Security Deployment Guide (PDF) - Websense

General Deployment RecommendationsComponent suggestionsThis section includes suggested component deployment ratios. The optimumdeployment may vary based on network configuration and Internet traffic volume.Larger systems (more than 1000 users) may require a more distributed deployment forload balancing and support of multiple languages.Multiple Network Agent instances may be required, for example, to detectoutbound traffic on individual network segments.It may be appropriate to install multiple Filtering Service instances for loadbalancing. Some load balancing configurations allow the same user to be filteredby different Filtering Service installations, depending on the current load.This section includes: Network Agent suggestions, page 28 Number of Filtering Services allowed per Policy Server, page 28For limits on transparent identification agents, see Deploying transparentidentification agents, page 31.For more information about the interaction of Websense components, see theInstallation Guide Supplement for the integration used with your Websense software,and the Websense Manager Help.Network considerationsTo ensure effective filtering, Websense software must be installed so that:Filtering Service can receive HTTP requests from an integrated firewall, proxyserver, or caching application, or Network Agent.In a multi-segmented network, Filtering Service must be installed in a locationwhere it can both receive and manage Internet requests from the integrationproduct and communicate with Network Agent.Network Agent:• Must be deployed where it can see all internal Internet traffic for the machinesthat it is assigned to monitor.• Can be installed on a dedicated machine to increase overall throughput.• Must have bidirectional visibility into Internet traffic to filter non-HTTPrequests (such as instant messaging, chat, streaming media, and other Internetapplications and protocols).• Multiple instances of Network Agent may be required in larger or distributednetworks. Each Network Agent monitors a specific IP address range ornetwork segment.Using multiple Network Agents ensures that all network traffic is monitored,and prevents server overload. The required number of Network Agentsdepends on network size and Internet request volume.Deployment Guide 27