This is from the Websense deployment guide:
To ensure effective filtering, Websense software must be installed so that:
- Filtering Service can receive HTTP requests from an integrated firewall, proxy
server, or caching application, or Network Agent.
In a multi-segmented network, Filtering Service must be installed in a location
where it can both receive and manage Internet requests from the integration
product and communicate with Network Agent.
- Network Agent:
- Must be deployed where it can see all internal Internet traffic for the machines
that it is assigned to monitor.
- Can be installed on a dedicated machine to increase overall throughput.
- Must have bidirectional visibility into Internet traffic to filter non-HTTP
requests (such as instant messaging, chat, streaming media, and other Internet
applications and protocols).
- Multiple instances of Network Agent may be required in larger or distributed
networks. Each Network Agent monitors a specific IP address range or
network segment.
Using multiple Network Agents ensures that all network traffic is monitored,
and prevents server overload. The required number of Network Agents
depends on network size and Internet request volume.
