Secure Web Gateway leverages DNS to help secure your workstations, or, if you create a Network Location, your entire network (including mobile devices that connect to your internal network). Since the service can be configured at the Network level, the licensing is different than our strictly Agent-based services (such as Antivirus, Content Filtering).
In these cases, you simply license for each device on which you are installing and enabling the service. With Secure Web Gateway, you can protect all users in your environment, regardless of what type of device they are using. If they are using your DNS server, they will be protected. Therefore, the licensing is "per seat" instead of "per device."
What is a Seat?
A Seat is defined as a user who will use the service by accessing the internet via one or more devices in the network. This means that you can choose any combination of Device based or Network Location based protection, as long as you are licensing for the total amount of seats being used.
I have 100 users in my environment, and they use a combination of 150 devices in their day to day work (laptops, mobile devices, tablets), and 15 of these devices are remote or traveling users off the network.
You could set up a Network Location, and forward your DNS lookups to SWG servers, protecting the entire network. Additionally, you would enable SWG at the agent level for the 15 laptops that leave the network, so that they receive protection no matter where they are.
So, you have a Network Location protecting the network users, and 15 devices with SWG enabled for remote and traveling users. Therefore, you would want to license for the 100 seats in total to ensure protection and compliance.
I only want to protect certain devices in my environment- I have 25 users that use laptops, and do not want to enable Network Location protection.
In this case, you would simply install CloudCare agents, enable SWG on those devices, and configure the policy. You would only want to license 25 seats in this case.
I have 3 locations with 30 users in each one and wish to protect users on my Guest Wi-Fi network.
In this case, you would want to set up 3 Network Locations in CloudCare. You could choose to assign them all to the same policy or have different policies for each location. Then enable SWG on the laptops that may leave the Network. Also, ensure that the Guest Wi-Fi networks are also configured to send their DNS queries to SWG servers.
Now, take an average on how many people would use your guest Wi-Fi in one day. Take that average and add that to your license count. Let’s say you get about 10 people in your office each day using Wi-Fi.
You would want to license 90 seats + 10 guest Wi-Fi users, for a total of 100 seats. The amount of locations or agents is not important. Only the total amount of users you are protecting.
Avast can review the number of connections/requests made, and at the end of each month, review those requests against the licensed amount. The average expectation for one user is around 2,000 DNS queries per day, averaged out over an entire month. Your sales representative will reach out to you for a discussion if you are materially over the expected amount for more than one month (we realize there could be a spike in the average, so one overage would not cause a conversation).