Technical Library | Support

Go to the table of contents Go to the previous page Go to the next page
Deploying Web Security for a distributed enterprise > Web Security distributed enterprise deployment models
Web Security distributed enterprise deployment models
Deployment and Installation Center | Web Security Solutions | Version 7.8.x
Applies to:                                         
In this topic                                       
*
Web Filter, Web Security, Web Security Gateway, and Web Security Gateway Anywhere, v7.8.x
*
Sites in a region
*
Expanding sites in a region
*
National or worldwide offices
Deployment scenarios vary with different enterprise configurations. For example, an organization with 50 remote sites, all located in the same general region, deploys Websense software differently than a company with remote sites spread throughout the world. This section discusses 3 basic example models for distributed enterprises:
*
Sites in a region: Remote sites located within one region
*
Expanding sites in a region: Remote sites located within one region, with a growing number of employees or sites (or both)
*
National or worldwide offices: Remote sites located nationally or globally
Sites in a region
The simplest Websense deployment for a distributed enterprise is a network with remote sites in a single region, such as San Diego County, California, U.S.A. Most organizations with sites like this can use a single Websense Web Security or Web Security Gateway deployment, centrally located within that region, to provide policy enforcement for all clients.
Each remote site would be managed as shown in the illustration under Websense Web Security or Web Security Gateway. The site at which Websense software is deployed is represented as the "main site", but need not be truly a main site in your organization. It is whichever one houses Websense software.
Off-site users, not shown in the above illustration, can be handled using Websense remote filtering software. See Deploying Remote Filtering Server and Client.
Expanding sites in a region
Some organizations deploy Web Security or Web Security Gateway within a given region and later decide to increase the number of remote sites in that area.
To compensate for the additional sites and employees, the organization can:
*
Improve the performance of the machines running Websense components. Increasing the RAM and CPU, and installing faster hard drives on the Websense machines allows Websense software to respond to an increased number of requests without additional latency. This type of upgrade can help with a moderate increase in head count, or the addition of a few more offices.
*
Deploy additional machines to run Websense components. If a significant number of new users or sites is added, the deployment of additional instances of certain Websense components, such as Filtering Service and Network Agent, distributes the load and provides optimum performance for each remote site.
Additional instances of Websense components can be deployed within the region as the number of offices continues to grow.
Off-site users, not shown in the preceding illustration, can have their requests handled by Websense remote filtering software. See Deploying Remote Filtering Server and Client.
National or worldwide offices
Websense Web Security or Web Security Gateway
Some organizations have hundreds of remote sites spread through a country or around the world. In such cases, one or two Web Security or Web Security Gateway installations are not enough because:
*
Each remote site would be geographically distant from the Websense components. Request lookups would have to travel farther over the Internet to reach Websense software. This distance increases the total latency of the response and may lead to slower Internet access for end users.
*
Large numbers of employees generate more Internet requests than recommended for one or two Websense machines, leading to delays in returning web pages to requesting clients.
These organizations should divide their sites into logical regions and deploy Websense software in each region. For example, a distributed enterprise might group their United States sites into a western region, a central region, and an eastern region. Websense software is deployed at a central site in each region.
The logical division of sites into regions depends on the location and grouping of remote sites and the total number of employees at each site. For example, a company with a large number of remote sites in a concentrated area, such as New York City, may need to deploy multiple machines running Websense software within that area. Or an enterprise may only have three sites in California with 100 to 250 employees each. In this case, a single Websense software installation might be deployed for all three sites. This enterprise also can deploy Websense software locally at each site (rather than using a distributed approach), particularly if IT staff is present at each location.You may consider installing instances of Filtering Service, Network Agent, and possibly Policy Server and Content Gateway to improve response time.
Given the significant number of variables, large organizations should contact a Websense partner or Websense Sales Engineering to plan a rollout strategy before deployment.
Websense Web Security Gateway Anywhere
Websense Web Security Gateway Anywhere is particularly well-suited for organizations with sites distributed nationally or worldwide.
Single main site
An organization with one main site (such as headquarters office or main campus) and multiple, geographically dispersed remote or branch sites can deploy Websense software at the main site (with policy enforcement for main-site users managed by the on-premises components) and have all remote sites managed by the hybrid service.
Off-site users, not shown in the above illustration, may either be managed by the hybrid service, or with Websense remote filtering software. See Deploying Remote Filtering Server and Client.
Multiple large sites
Organizations with multiple large sites (such as main headquarters and regional headquarters) can deploy on-premises Web Security software at the larger sites while managing small, remote sites through the hybrid service. Though the illustration shows a V-Series appliance deployment, this can also be accomplished with software-only deployments.
When there are multiple on-premises deployments of Web Security Gateway Anywhere components:
*
There must be only one Policy Broker and one Sync Service in the entire deployment (at the main site). See Extending your Web Security deployment and the Web Security Help for more information.
*
For unified configuration and policy-application, V-Series appliances deployed at regional sites should be configured to use the appliance at the main site as the full policy source. See the appliance Getting Started Guide and the Appliance Manager Help.
*
All Log Server instances should be configured to send data to the main Log Database at the main site. See the Web Security Help for more information.
Off-site users, not shown in the above illustration, may either be managed by the hybrid service, or with Websense remote filtering software. See Deploying Remote Filtering Server and Client.

Go to the table of contents Go to the previous page Go to the next page
Deploying Web Security for a distributed enterprise > Web Security distributed enterprise deployment models
Copyright 2016 Forcepoint LLC. All rights reserved.