In centralized organizations that route all outbound Internet requests through a single large Internet connection, the servers running Websense software are normally placed physically close to the firewall, proxy server, or network appliance.
Rather than deploying Websense software at each remote-site firewall, you can deploy Websense components in a geographically central location. Since Websense software is accessible from the Internet, the Websense components should be protected by a firewall that allows URL lookup requests to pass through.
Filtering is performed by the Websense components at the main site. Remote sites must be equipped with a firewall that can be integrated with Websense software (configured to check with Websense software to permit or block Web requests), or an instance of Websense Network Agent must be deployed at the remote site.
Firewall is used here as a generic term to refer to a firewall, gateway, or proxy.
Websense, Inc. has tested this configuration in cooperation with several of its integration partners. The same deployment methodology described here can be used with any supported network security product integrated with Websense software. A full list of supported integration products can be found at:

User requests a Web page.

Local firewall checks the URL of the requested page with Websense Web Security/Web Security Gateway over the Internet.

Websense Web Security/Web Security Gateway responds over the Internet, indicating whether the request should be permitted or blocked.

Local firewall permits or blocks the request as directed.
Note the preceding illustration is a simplified diagram showing the main conceptual sequence of events. Do not install any Websense components on a domain controller.
Details of Websense component distribution and placement in the corporate network, network routing and internal firewall usage, segmentation of networks, and so forth are addressed in other sections of the Deployment Center.
Off-site user machines are filtered by deploying Websense Remote Filtering Server at the main site. Websense Remote Filtering Client is installed on each off-site machine to be filtered. See
Remote Filtering Software technical paper for details.
The following illustration shows how remote-site filtering works in Web Security Gateway Anywhere. Remote site client machines are filtered by the hybrid service directly rather than instructing the local firewall to permit or block a request. A user's request for a Web page is directed to the hybrid service, which permits or blocks the request based on the applicable policy.

Policy settings are defined at the main site and uploaded automatically to the hybrid service at preset intervals. User information, for user- or group-based filtering, is also uploaded.
Log data for reporting is downloaded from the hybrid service to the main site automatically and is incorporated into the Websense Log Database (at the main site). Thus, reports can cover users at all offices.
Off-site users are filtered by the hybrid service as well. Alternatively, off-site users can be filtered using Websense Remote Filtering Server (deployed at the main site). In that case, Websense Remote Filtering Client must be installed on each off-site user's machine. See
Remote Filtering Software technical paper for details.