Deploying transparent identification agents

Applies to

Web Filter v7.6

Web Security v7.6

Web Security Gateway v7.6

Web Security Gateway Anywhere v7.6

In this topic

u

Overview

u	Combining transparent identification agents

Overview

If you are using Websense software as a stand-alone deployment, or if your integration product does not send user information to Websense software, use Websense transparent identification agents to identify users without prompting them for a user name and password.

There are 4 optional transparent identification agents:

DC Agent

eDirectory Agent

Logon Agent

RADIUS Agent

 

Note  DC Agent must have domain administrator privileges to retrieve user information from the domain controller.

If you have deployed Websense software in a single network location, it is a best practice to have a single transparent identification agent instance.

In deployments that cover multiple locations, you can install an agent instance in multiple domains.

For example:

One DC Agent instance can handle multiple trusted domains. Add additional instances based on:

The load placed on DC Agent

Whether a DC Agent instance can see all the domains on the network, including remote offices

Load results from the number of user logon requests. With a large number of users (10,000+ users, 30+ domains), having multiple DC Agent instances allows for faster identification of users.

If multiple Filtering Services are installed, each Filtering Service instance must be able to communicate with all DC Agent instances.

One eDirectory Agent is required for each eDirectory Server.

One Logon Agent is required for each Filtering Service instance.

One RADIUS Agent instance is required for each RADIUS server.

It is a best practice to install and run RADIUS Agent and the RADIUS server on separate machines. (The agent and server cannot have the same IP address, and must use different ports.)

In some environments, a combination of transparent identification agents may be appropriate within the same network, or on the same machine. See Combining transparent identification agents.

See Installing Web Security components for transparent identification agent installation instructions. See the TRITON - Web Security Help for detailed configuration information. More information is also available in the Transparent Identification of Users technical paper.

Combining transparent identification agents

Websense software can work with multiple transparent identification agents. If your environment requires multiple agents, it is best to install them on separate machines.

eDirectory or RADIUS Agent can be installed on the same machine as Filtering Service, or on a separate server on the same network.

Do not run eDirectory Agent and DC Agent in the same deployment.

The following table lists supported combinations of transparent identification agents.

Combination	Same machine?	Same network?	Configuration required
Multiple DC Agents	No	Yes	Ensure that all instances of DC Agent can communicate with Filtering Service, and that the individual DC Agents are not monitoring the same domain controllers.
Multiple RADIUS Agents	No	Yes	Configure each agent to communicate with Filtering Service. Multiple instances of the RADIUS Agent cannot be installed on the same machine.
Multiple eDirectory Agents	No	Yes	Configure each instance to communicate with Filtering Service.
Multiple Logon Agents	No	Yes	Configure each instance to communicate with Filtering Service.
DC Agent + RADIUS Agent	Yes	Yes	Each agent must use a unique port number to communicate with Filtering Service. By default, DC Agent uses port 30600; RADIUS Agent uses port 30800.
DC Agent + eDirectory Agent	No	No	Communication with both a Windows directory service and Novel eDirectory is not supported in the same deployment. However, both agents can be installed, with only one agent active.
DC Agent + Logon Agent	Yes	Yes	Configure each agent to use a unique port to communicate with Filtering Service. By default, DC Agent uses port 30600; Logon Agent uses port 30602.
RADIUS Agent + Logon Agent	Yes	Yes	Configure all agents to communicate with Filtering Service.
eDirectory Agent + Logon Agent	No	No	Communication with both Novell eDirectory and a Windows- or LDAP-based directory service in the same deployment is not supported. However, both agents can be installed, with only one agent active.
RADIUS Agent + eDirectory Agent	Yes	Yes	Configure each agent to use a unique port to communicate with Filtering Service. By default, eDirectory Agent uses port 30700; RADIUS Agent uses port 30800. When adding agents to TRITON - Web Security, use an IP address to identify one, and a machine name to identify the other. See the Transparent Identification of Users white paper for details.
DC Agent + Logon Agent + RADIUS Agent	Yes	Yes	This combination is rarely required. Configure each agent to use a unique port to communicate with Filtering Service. By default, DC Agent uses port 30600; Logon Agent uses port 30602; RADIUS Agent uses port 30800.