Cisco Cisco Web Security Appliance S170 사용자 가이드
D E P L O Y M E N T P L A N N I N G
C H A P T E R 1 : I N T R O D U C T I O N T O S A W M I L L F O R I R O N P O R T
9
D E P L O Y M E N T P L A N N I N G
Network Planning
Small Deployments
For IronPort evaluations, or single appliance deployments, there are two methods of data
transfer available, but the Push Method is the preferred and the one intended to scale to large
network environments.
transfer available, but the Push Method is the preferred and the one intended to scale to large
network environments.
• Pull Method. Consolidated Architecture: Without Log Repository.
• Pro: Requires less Reporting Server disk space.
• Con: Once the Web Security appliance rotates its logs, the original logs will be lost,
destroying forensic evidence and preventing Reporting database rebuilds.
• Push Method. Consolidated Architecture: With Log Repository.
• Pro: The original logs will be available as forensic evidence and for Reporting
database rebuilds.
• Con: Reporting Server will require additional disk space.
Large Deployments
• Consolidated Push Method: Have each Web Security appliance push its logs to a single
off box repository where Sawmill is installed locally.
WSA_Sawmill.book Page 9 Tuesday, February 22, 2011 2:54 PM