Deployment options

Overview > Deployment options

Deployment options

Help | Content Gateway | Version 7.7.3

As a Web proxy cache

When Content Gateway is deployed as a Web proxy cache, user requests for Web content pass through Content Gateway on their way to the destination Web server (origin server). If the Content Gateway cache contains the requested content, Content Gateway serves the content directly. If the Content Gateway cache does not have the requested content, Content Gateway acts as a proxy, fetching the content from the origin server on the user's behalf, while keeping a copy to satisfy future requests.

Content Gateway is typically deployed to receive client requests in one of the 2 following ways:

As an explicit proxy in which the user's browser or client software is configured to send requests directly to Content Gateway. See Explicit Proxy.

As a transparent proxy in which user requests are transparently routed to Content Gateway on their way to the destination server. The user's client software (typically a browser) is unaware that it is communicating with a proxy. See Transparent Proxy and ARM.

In a cache hierarchy

Websense Content Gateway can participate in flexible cache hierarchies, where Internet requests not fulfilled in one cache can be routed to other regional caches, taking advantage of their contents and proximity. In a hierarchy of proxy servers, Content Gateway can act either as a parent or child, either to other Content Gateway servers or to other caching products. See Hierarchical Caching.

In a managed cluster

Websense Content Gateway scales from a single node to multiple nodes, forming a managed cluster that improves system capacity, performance, and reliability.

A managed cluster detects the addition and removal of nodes.

Cluster nodes automatically share configuration information, allowing members of the cluster to all be administered at the same time.

When SSL Manager is enabled, SSL configuration information is also propagated around the cluster. However, the mechanism used to synchronize information is different from that used by other information.

If the virtual IP failover option is enabled, Content Gateway maintains a pool of virtual IP addresses that it assigns to the nodes of the cluster. Content Gateway can detect node failures (such as power supply or CPU failures) and reassign IP addresses of the failed node to the operational nodes. See Virtual IP failover, for details.

If Content Gateway is configured as a transparent proxy with WCCP, failover is handled by WCCP and virtual IP failover should not be used. See WCCP load distribution.

For complete information, see Clusters.

As an SSL server

If SSL Manager is enabled, HTTPS data is decrypted, inspected, and re-encrypted as it travels to and from the client and origin server.

Content Gateway does not cache HTTPS data.

SSL Manager includes a complete set of certificate-handling capabilities. See Working With Encrypted Data.


	Important Even when SSL Manager is not enabled and HTTPS is not decrypted, Content Gateway performs HTTPS URL filtering. This means that for every HTTPS request, a URL lookup is performed and policy is applied. In explicit proxy mode, when SSL is turned off, Content Gateway performs URL filtering based on the Host name in the request. If the site is blocked, Content Gateway serves a block page. Note that some browsers do not support display of the block page. To disable this feature, configure clients to not send HTTPS requests to the proxy. In transparent proxy mode, when SSL is turned off, Content Gateway performs URL filtering based on the common name present in the certificate from the origin server. If the site is blocked, the connection with the client is dropped; no block page is served. To disable this feature when used with WCCP, do not create a service group for HTTPS.