Web Security Deployment Guide (PDF) - Websense

Deploying Network AgentNetwork Agent locationNetwork Agent must be able to see all outgoing and incoming Internet traffic on thenetwork segment that it is assigned to monitor. Multiple instances of Network Agentmay be needed to monitor an entire network.Multiple Network Agents may be needed for larger or high-traffic organizations.A Network Agent instance can be placed in each internal network segment.The Network Agent machine may be:Connected to a switch or router.• Configure the device to use a mirror or span port, and connect Network Agentto this port, to allow the agent to see Internet requests from all monitoredmachines. (On most switches, you can change a port mode to spanning,mirroring, or monitoring mode. The term varies by manufacturer; the functionis the same.)NoteNot all switches support port spanning or mirroring.Contact the switch vendor to verify that spanning ormirroring is available, and for configuration instructions.• Websense, Inc., strongly recommends using a switch that supportsbidirectional spanning. This allows Network Agent to use a single networkcard (NIC) to both monitor traffic and send block pages.If the switch does not support bidirectional spanning, the Network Agentmachine must have at least 2 NICs: one for monitoring and one for blocking.See Using multiple NICs, page 61.On a dedicated machine, connected to an unmanaged, unswitched hub locatedbetween an external router and the network.To ensure that Network Agent is able to monitor the expected traffic, you must bothposition the Network Agent machine appropriately, and configure Network Agentsettings in Websense Manager. Consult the Websense Manager Help for instructions.The following sections illustrate possible single and multiple Network Agentconfigurations.Deployment Guide 49