What is a policy source?

Every TRITON AP-WEB deployment must include a policy source. This is an appliance or other server that hosts TRITON Policy Broker, TRITON Policy Database, and TRITON Policy Server.

When the policy source is a Windows server, TRITON management server components typically also reside on the machine.

When the policy source is an appliance, the components listed below also reside on the machine.

All other V-Series appliances and other TRITON servers point to the policy source server or appliance and receive regular updates from it.

The Policy Database holds all security policies (including client definitions, filters, and filter components) for all appliances and all domains in the network. It also holds global configuration information that applies to the entire deployment.

Policy Broker controls access to the information in the Policy Database.

You deploy Policy Broker in standalone or replicated mode:

In standalone mode, there is one Policy Broker for the entire deployment. All Policy Servers connect to the same Policy Broker. In this mode, Policy Broker can reside on a Windows or Linux server, or a V-Series appliance.

In replicated mode, there is one primary Policy Broker, to which configuration and policy changes are saved, and one or more replica instances, each with its own read-only copy of the configuration and policy data. Each Policy Server can be configured to determine whether it attempts to connect to the primary Policy Broker or a replica instance at startup.

In a replicated configuration, Policy Broker cannot reside on a V-Series appliance. Both the primary and replica instances must be hosted by a Windows or Linux server. See Managing Policy Broker Replication for more information.

When a TRITON AP-WEB only appliance is configured as a policy source, most Web components may run on that appliance, including:

Directory Agent (requires Web Hybrid module; user directory and filtering appliances only)

Multiplexer (disabled by default; not available on filtering only appliances)

State Server (optional; disabled by default)

Network Agent (optional)

Windows-only services, like Log Server, TRITON Manager, and optional services, like transparent identification agents, must run on other machines.