Date post: | 18-Nov-2014 |
Category: |
Technology |
Upload: | jimmy-saigon |
View: | 4,054 times |
Download: | 0 times |
Advanced Dynamic Services forUnified Access and Control
Presenter
2
How the Static Data Center Falls Short
• It started simple• More user types, services• Application issues• Security woes …• What’s the answer?
Complexity is the Enemy
of Good Security
3
Dynamic Data Center
• Reconfigure dynamically
• Manage applications, not objects
• Context-aware policies• ADC manages
application services
4
Mobile and Remote Users Growing Dramatically
1.2 Billion Mobile Workers WW by 2013
IDC Research 2010
5
One Access SolutionBIG-IP Access Policy Manager
All AccessUse Cases
BIG-IP Access Policy Manager
Web Access Management:• Proxy to HTTP apps
– Custom– 3rd party
Remote Access: • SSL VPN
– Network Access– Portal Access– App Tunnels
Application Access Control:• Proxy to Non-HTTP apps
– Citrix ICA– ActiveSync– Outlook Anywhere
6
Dynamic Services for Unified Access Control BIG-IP Access Policy Manager in BIG-IP Edge Gateway
• Unify Remote, Web and Application Access
• Fast Access, Authentication and SSO to Apps
• Ensure Strong Endpoint Security
• Scale to Support All Mobile and Remote Users
• Powerful Custom and Built-in Reporting
Manage Access Based on Identity
7
Secure, Accelerated Remote Accesswith BIG-IP APM in Edge Gateway
Edge Gateway includes:• BIG-IP APM, WA and WOM
8
BIG-IP Edge Gateway
• Next generation remote access solution– Converges SSL VPN access security, application
acceleration and availability– Optimize access for mobile users and remote offices
Secures and Accelerates Access to Applications
• BIG-IP Solution for the Network Edge– Multiple Platforms: 1600, 3600, 3900, 6900, 8900, 11000
– (Licensed concurrently)– Includes BIG-IP Edge Client solution
• Exponential Performance, Capacity, and Scalability– Up to 10 Gbps, 600 log-ins per second, 60,000 users
9
Secure and Accelerate Application Accesswith BIG-IP Edge Gateway (APM+WA+WOM)
Data Center
10
• Prioritize critical traffic • Dedicated bandwidth per application• No tunneling conflicts of traditional SSL VPN
SECURE APPLICATIONS & DATA
• Centralize access policy enforcement
• Single Sign-On• L4 – L7 full proxy access control • Advanced endpoint security• Secured optimized tunnels• Content encryption
OPTIMIZED APPLICATIONS & DATA
• Caching repetitive content in browser
• Intelligent Compressing• TCP optimization
Secure and Accelerate Application Accesswith BIG-IP Edge Gateway (APM+WA+WOM)
Data Center
11
SharePoint
Accelerate Application Performancewith faster portal file downloads
CompetitorSSL VPN
BIG-IP Edge Gateway ▲
First Access 211 seconds 114 seconds 1.9×
Repeat 47 seconds 16 seconds 2.9×
SAP CompetitorSSL VPN
BIG-IP Edge Gateway ▲
Access 111 seconds 14 seconds 7.9×
F5 tested a first-time user’s attempt:• SharePoint: 4 MB document download• SAP: 27 MB Microsoft Office file
12
Scale to Support the Most Mobile Userswith BIG-IP Edge Gateway (APM+WA+WOM)
Solution:Employees experience no delay or bottlenecks becauseBIG-IP Edge Gateway:
• Provides secure remote access with up to 10 Gbps of SSL VPN throughput
• Supports up to 60,000 concurrent users and 600 logins per second
Scenario:Extreme weather results in 150% more employees than usual working and accessing the network from home
13
Disparate connections and application restarts
Ongoing Logins!
At Home (wireless)
On the way to work(Aircard)
In the office(docked LAN connection)
Presenting(corporate wireless)
Constantly Re-connecting
In the Cafe(wireless)
?
?? ?
?
14
Increase User Productivity with Anywhere AccessAuto-Connect to VPN with Flexible Client Technology
Auto-Connect!
At home (wireless)
On the way to work(Aircard)
In the office(docked LAN connection)
Presenting(corporate wireless)In the cafe
(wireless)
Always Connected Application Access
15
• Flexible Deployment– Web-Delivered and Standalone Client– Mac, Windows, Linux– iPhone, iPad, iTouch
• Drive Security– Endpoint inspection– Full SSL VPN– Per-user flexible Policy
• Enable Mobility– Smart connection roaming– Uninterrupted application sessions
• Accelerate Access– Adaptive compression– Client-side cache– Client-side QoS
BIG-IP Edge Client
16
Easily Design Access for iPhoneBIG-IP Edge Client Connection, Statistics and Settings
17
Easily Design Access for iPadBIG-IP Edge Client Connection, Statistics and Settings
18
Configure iOS Access to Applicationswith BIG-IP Edge Portal
19
• Provide access based on device and identity
• Make dynamic policy decisions
• Authenticate users
• Provide remediation for non-compliant devices
Mobile Clients for Fast App. Access
20
BIG-IP Edge Portal for Android App Solutions
Fast App. Access for Android Devices
https://market.android.com/details?id=com.f5.edge.portal
21
Ensure Strong Endpoint Security
• Antivirus software versionand updates
• Software firewall status
• Access to specific applications
• Restrict USB access
• Cache cleaner leaves no trace
• Ensure no malware enters corporate network
Allow, deny, or remediate users based on endpoint attributes such as:
Invoke protected workspace for unmanaged devices:
BIG-IP Edge Gateway
22
Internet Facing Applications
Remote Users
Data Center
Directories
BIG-IP Edge Gateway+Access Policy Manager
+WebAccelerator+WAN Optimization Manager
23
Private Public
Cloud
Enterprise and Service Provider IT
Mobile & Remote Users
App 1 App n
Network Users
Data Center Applications
Directories
Data Center
BIG-IP Edge Gateway+Access Policy Manager
+WebAccelerator+WAN Optimization Manager
24
F5 Unified Access and ControlFlexible and Dynamic ADC Services
BIG-IP Edge Gateway+Access Policy Manager
+WebAccelerator+WAN Optimization Manager
Headquarters and Remote Offices
CorporateWAN
IPsec: Optimized Site-to-Site Tunnels
Internet
BIG-IP System Virtual Editions
BIG-IP Edge Gateway
Data Center
BIG-IP GlobalTraffic Manager
BIG-IP LocalTraffic Manager
+Access Policy Manager
Mobile and Remote Users
Public/PrivateCloud
Optimized Applications to BIG-IP Edge Client
• Supports users worldwide
• Secure IPsec site to site tunnels
• Fast apps to Edge Client users
• Virtual and standalone deployments
25
Flexible and Dynamic Access Services Dynamic Webtop, App. Tunnels and Remote Desktop Support
26
Authentication All in One and Fast SSO F5 BIG-IP Access Policy Manager
Dramatically reduce infrastructure costs; increase productivity
= BIG-IP v11
27
New Detailed ReportingQuickly Run Built-in or Design Custom Reports
Custom, Built-in and Saved reports
Exported and usedon other devices
e.g How many XP users are still on my network?
e.g. Who accessed app. or network and when?
e.g. Where are users accessing from (geolocation)?
28
Access and ApplicationAnalytics
Stats Collected• Client IPs• Client Geographic• User Agent• User Sessions• Client-Side Latency• Server Latency• Throughput• Response Codes• Methods• URLs
Views • Virtual Server• Pool Member• Response Codes• URL• HTTP Methods
• Stats grouped by application and user • Provides
– Business Intelligence– ROI Reporting– Capacity Planning– Troubleshooting– Performance
29
Access Policy Design
• Industry-leading advanced Visual Policy Editor (VPE)– Flexible– Easy to understand, visual representation of policy– VPE Rules (TCL-based) for advanced functions– Trigger TMM iRules events
• Usability features– Macros– Visual cues to aid configuration
30
Users
Lack of simplicity, flexibility, context, and control for the enterprise
Resources
Physical Virtual Multisite data centers
Private Public
Cloud
VPN
Vendor A
Web Accelerator
Vendor B
WAN Optimizer
Vendor C
LDAP
OAM
TAM
CAAAA
AAA AAAAAA AAA AAA
AAA AAA AAA
AAA x 10
AAA x 5AAA x 2
AD AD
• No context• Difficult change control• Error-prone• Costly• Licensing/vendor management
issues• Compliance problems• Limited control
AD
DNS Bind Server
Open Source
?
Improve Manageability and Reduce Costs
31
Users
Simplicity, flexibility, context, and control for the enterprise
Resources
Physical Virtual Multisite data centers
Private Public
CloudLDAP
OAM
TAM
CAAAA
AAAAAA AAA AAA
AAA AAA AAA
AAA x 10
AAA x 5AAA x 2
AD AD
AD
BIG-IP Edge GatewayBIG-IP Global Traffic Manager
VPN
Vendor A
Web Accelerator
Vendor B
WAN Optimizer
Vendor C
DNS Bind Server
Open Source
AAA
Use
r R
eq
ue
sts
Op
tima
l Ga
tew
ay
• Unified access and acceleration model
• Simplified change control and auditing
• Flexible access policies• Context-aware: user, device,
location, and application• Control remains within
enterpriseA
AA
Sec
ure
Opt
imiz
ed S
essi
on
Secure Optimized Session
Improve Manageability and Reduce Costs
32
Benefits:• WAN optimization = fast connection for mobile users on 64-bit OS• Improved VoIP, with fewer dropped calls• Active Directory integration eliminates multiple logins• Fast, easy installation• Implemented: Edge Gateway, LTM, GTM.
Challenges: Slow connection times meant slow transfers Couldn’t connect to VPN with 64-bit OS VoIP issues caused dropped calls Lack of support required costly upgrades
Optimal gateways and secure optimized sessions
“With the Edge Gateway, the connection speed was immediately noticeable.” Steve Diggory, Technology Manager, PersonalizationMall.com
Case Study: http://www.f5.com/pdf/case-studies/personalization-mall-cs.pdf Industry: Online Specialty Retail
33
The Most Scalable Access Solution
0
1
2
3
4
5
6
7
8
F5CiscoJuniperCitrix
Juniper SA45002X Cisco 5520Citrix MPX5500
6X Citrix MPX215006X Cisco ASA 5580
F5 BIG-IP 11050
7X JNPR SA65003X Juniper SA45003X Cisco 55853X Citrix MPX10500
F5 BIG-IP 1600 F5 BIG-IP 6900 F5 BIG-IP 8900
Number of Concurrent Users Supported
Nu
mb
er o
f D
evic
es
Req
’d
34
Multiple Platform Solutions
Platform(APM on LTM)
Base Conc. Users
Max Conc. Users
Platform(Edge
Gateway)
Base Conc. Users
Max Conc. Users
Virtual Edition
250 500 - - -
1600 500 1,000 1600 300 1,000
3600 500 5,000 3600 500 5,000
3900 500 10,000 3900 1,000 10,000
6900 500 25,000 6900 2,500 25,000
8900 500 40,000 8900 5,000 40,000
8950 500 40,000 - - -
11000 500 60,000 11000 10,000 60,000
11050 500 60,000 - - -
35
Dynamic Services for Unified Access Control BIG-IP Access Policy Manager in BIG-IP Edge Gateway
• Unify Remote, Web and Application Access
• Fast Access, Authentication and SSO to Apps
• Ensure Strong Endpoint Security
• Scale to Support All Mobile and Remote Users
• Powerful Custom and Built-in Reporting
Manage Access Based on Identity
37
Multiple-Domain Single Sign-On
• Single Sign-On to multiple LTM/APM or Edge Gateway virtual servers front ending multiple separate domains or multiple hosts within same domains
• Configure different cookie settings and SSO methods for different domains or different hosts in the same domain
Ex. Multiple domains with different SSO methods
38
Dynamic Webtop for End-User
• Customizable and localizable list of resources
• Adjusts to mobile devices• Toolbar, help, and
disconnect buttons
39
Endpoint Inspection – Machine Information
• CPU Info {ID, Name, Clock}• HDD {Model, Serial#}• Motherboard {Model, Serial#}
• BIOS {Dell, Serial #, Manufacturer}
• NICs {Name, MAC}
40
Application Tunnels
• Layered with Symmetric Adaptive Compression services
41
Microsoft RDP Remote Desktop
Microsoft RDP Remote Desktop
42
Symmetric Adaptive Compression to Edge Client
• iSession-style optimization of Network Access tunnels• Layer with DTLS
– DTLS for fast response of real-time applications– Optimization reduces bandwidth
43
Edge Client v1.0.1
• Secure web gateway proxy support• Pre-logon checks • Auto application launch
44
Secure Web Gateway Integration
• Allows admin to force all web access through a secure gateway
• Bypasses secure gateway for internal resources
• All traffic is forced through the tunnel
• Why? Enforce web browsing policies on corporate iPads e.g.
45
Secure iPad Web Surfing with Edge Client
BIG-IP Edge
Gatewaywith APM
Full SSL-VPN
Tunnel
Internet
Gateway
Internal Resource
46
Pre-logon checks for iOS Devices
• Four new session variables:– session.client.mac_address– session.client.model– session.client.platform_version– session.client.unique_id
• These session variables are gathered automatically and are available with Solstice and Edge Client 1.0.1
• They can easily be combined with an LDAP/AD Query to implement white-listing in a custom action.
• Why? Discriminate IT approved issued devices. Improved access context.
47
Checking the iOS Unique ID
• Custom action “Device ID Check” in this access policy checks a UUID…
48
App auto-launch
• After Edge Client connects, initiate and auto-launch a 2nd application on the device.
• Uses a URL form for the App Path– http://handleopenurl.com/– http://wiki.akosma.com/IPhone_URL_Schemes
• Issues pre-launch warning
49
App Auto-launch
Skype configured to auto-launch…
50
BIG-IP Edge Client for BIG-IP v10.2.1
iMac Edge Client (Leopard/Snow Leopard)
51
BIG-IP® LTM
+ASM (opt)
+ WA (opt)
App 1
OAM Policy Server, Reporting,
and Auditing
…
App n
MobileEmployees and
Contractors
Data Center
• Mobile employees accessing corporate applications using VPN
• OAM auth. services are performed by Edge Gateway in the DMZ
• OAM auth. services may be performed by BIG-IP® Edge Gateway in the DMZ or at the web server with “last mile” security
• Eliminate a directory service for remote access users
Web App+ OAM (opt)
DMZ
BIG-IP® Edge Gateway / OAM
Customer Architecture with Oracle Access Manager (OAM) and BIG-IP Edge ® Gateway
Authentication Proxy Integration – VPN
OAM Web Proxies
52
Security Risk: Mobile User Authentication Sync
• Access to Exchange without VPN to sync MS email, calendar, contacts
• Security risk• Extra infrastructure tier in DMZ
Data Center
MS Exchange
DMZ
Auth. Gateway ADC
53
Secure Environment: Authenticating ActiveSync Devices
• Reduce authentication infrastructure and sync with Exchange
• One location for name space URL • Scale and support growing mobile user base• Secure environment
BIG-IP® LTM + APM
Data Center
MS Exchange
DMZ
Auth. Gateway
54
Traditional Remote Access with SSL VPN
SaaS Partners
Internet
Unified Access on F5 BIG-IPs
Directories
Local and Mobile Users
Applications
Hosted Virtual Desktops
Consumer Apps
• Most powerful, scalable and simplified access solutions
Private Public
Cloud
BIG-IP LTM with APM
• Application access management
• Accelerated remote access
Dynamic Control with BIG-IP Access Policy Manager
with APM, BIG-IP Edge Gateway
WA, and WOM
App 1 App nSSL VPN
55
BIG-IP Edge Gateway will Power New Managed Services
Access Requirements• Easy / cost effective access scaling • Advanced, secure VPN with fast deployment• Custom look and feel per customer• Virtualized solution to maximize investment• Enable secure collaboration between 3rd parties
BIG-IP Edge Gateway Delivered• Superior scalability @ Lowest cost• Acceleration technology with LAN speed performance• Improved manageability and security with unified access • Customized domains for personalized experience• Virtual routing services with lower opex
56
• Acceleration– “First of all, the acceleration capabilities that came with it. It’s not just remote access that
it’s providing but also will provide a better user experience in the process leveraging the BIG-IP acceleration technology that’s already been there, so it’s a proven and well-known capability.”
• Secure and Granular Access Control – “Another factor that was key was the highly granular access control capabilities, so that
allows us to provide the differing levels of access for different types of user and different types of devices that I was talking about, with third parties, with personal devices, which makes it flexible for future needs as well.”
• Virtualization of Access Services– “One of the key things we were looking at in the evaluation as a managed service
provider was the ability to provide full virtualization for multiple customer environments (via BIG-IP Virtual Servers concept), and obviously high scalability, so that’s all a direction we’re heading in with the cloud computing model.”
• Converged Services Platform– “We can deliver multiple services on it, not just remote access, so it provides a point of
leverage for us as well.”
CSC - Why They Chose BIG-IP Edge Gateway
57
• Increases mobile productivity automatically entering Windows logon credentials when using Edge Client• Easier access to applications with seamless VPN access• ICSA Labs certified SSL-VPN solution
ApplicationsClients
BIG-IPEdge Gateway
Repeatable Access to Applications
58
Packet loss with TCP/SSL = high latency. Network squeezes VoIP
Traditional SSL VPN: Apps./VoIP sent simultaneously
User experiencing choppy communication
What did he say?
VoIP: Slow Applications Affect Productivity
• Ensuring positive end-user application experience a complex problem• Slow applications can be caused by a number of things:
– Packet loss due to chatty or jittery protocols– High latency LANs– Poorly designed apps.
Low Traffic App. growth
App. Spike Delivered App.
0%
20%
40%
60%
80%
100%
Max Bandwidth
Network Traffic
VoIP Traffic
59
Low Traffic App. growth
App. Spike Delivered App.
0%
20%
40%
60%
80%
100%
Max Bandwidth
Network Traffic
VoIP Traffic
Edge Gateway improves application and VoIP performance• Tight connection and prioritized traffic with dedicated app. bandwidth
– Client-side QoS for Windows machines: VoIP traffic first and apps. traffic second• Applications and upper layer protocols react to lost packet(s)
– Secures each packet
BIG-IP Edge Gateway manages app. performance
VoIP: Improved User Communications
Hear you loud and clear...
User: clear phone call
60
Security Problem: Geolocation Access Risk
• Need to block access from countries or regions
• Help with business intelligence of where users are accessing from • Looking for capacity planning and ability to audit the location
• Access policy based on location
UK Data Center
61
Enforcing Access Restrictions Simple, accurate, centralized enforcement
UK Data Center
App Servers
Solution
Centralized Location Control• Decreased risk – access is controlled
at perimeter• Reduced capital and operational
expenses through centralized control• Reduced application development time• Simplified network configuration
BIG-IP Edge Gateway
BIG-IP Edge Gateway with IP Geolocation
Database
62
Only ADC with Geolocation Access Rules
• VPE – Geolocation Rules• iRules not required• Custom session variables• Custom notification messages• Logging Client locations• Reporting
63
BIG-IP APM/Edge Gateway V11 FeaturesAdvanced Dynamic Services for Unified Access Control
• IPsec optimized site-to-site tunnels
• Dynamic Webtop: with Application Tunnels
• Access: External Dynamic ACLs, Flash patching, Oracle Access Manager 11g
• Hosted VDI: Microsoft Remote Desktops, Expanded Citrix VDI support (Proxy and Portal mode)
• SSO enhancements: SSO across multiple domains, Kerberos auth. (CAC cards, etc)
• EndPoint Inspection: Protected Workspace, Machine Info Inspector
• Powerful reporting/analytics: Custom & built-in reports, Access and Application Analytics for remote access solution
• Scale for Global enterprise: 11000 Series: ^60k users, w/1.2 TB of storage
64
Edge Gateway v10.2 Security Features• Edge Gateway
– Integration with Oracle Access Manager– ICSA Certified – SSL -VPN – Geolocation Agent in VPE– MS ActiveSync Support
• Edge Client – Reuse of Windows logon credentials
65
Edge Gateway v10.1 Features
• Secure accel. remote access– Remote Access, Application Acceleration and
Network Optimization– Global VPN and Unified Access to Datacenter– Dynamic per-session layer 4 - 7 (HTTP) ACLs– SSO/Credential Caching – TCP Optimization– Symmetric adaptive compression– Asymmetric and symmetric application
acceleration– Data de-duplication– MAPS and CIFS acceleration
• Dynamic User Access– Web-based and standalone BIG-IP Edge Client– Mobility: Domain detection and smart
connection– Acceleration: Dynamic data compression
• Thorough Device Inspection– Endpoint Inspection checks– Protected Workspace with encryption and
Virtual File System– Group policy integration– Virtual Keyboard
• Manageability / Usability– QoS on Windows machines (client side)– D-TLS (Datagram-Based TLS) Network
Access Transport for secure packets– Customizeable user interface – Policy import/export– Reporting and stats– Set-up deployment wizards– Dashboard executive summary
• Interoperability and Integration– Edge Gateway and GTM interoperability– Edge Gateway events in iRules– Splunk for F5 logging and reporting
• Virtualization Architecture– Multiple virtual Edge Gateways– Targeted at Service Providers and large
enterprises – Separate access policy grouping for each
virtual Edge Gateway– Can have separate security
administrators– Master administrator control
66
Edge Gateway – v10.1 Features
• Application Acceleration– TCP optimization for client to gateway and gateway to gateway
connections– Symmetric Adaptive Compression for client to gateway and gateway
to gateway connections– HTTP/HTTPS asymmetric acceleration for client to gateway
connections– HTTP/HTTPS symmetric acceleration for gateway to gateway
connections – Data de-duplication services for gateway to gateway connections– MAPI and CIFS acceleration for gateway to gateway connections
• D-TLS (Datagram-Based TLS) Network Access Transport
67
Edge Gateway – v10.1 Features
• Portal Access Security– OWA 2003, OWA 2007, SharePoint 2003, SharePoint 2007, MS Communicator
2007– Oracle Portal 3.0 (10g Release 2, version 10.1.2) – PeopleSoft Portal 9, PeopleSoft Portal HR 9– SAP Netweaver, – Notes 7, Notes 8
• Authentication and Authorization Services– RADIUS, LDAP, and AD support– SSO/Credential Caching: HTTP Basic, HTTP NTLMv1/v2, Cookie, Form, and
HTTP Header– Dynamic per-session layer 4 - 7 (HTTP) ACLs– Native RSA SecurID– RADIUS accounting– Authentication server redundancy
68
• Virtualization Architecture– Multiple virtual Edge Gateways– Targeted at Service Providers
(managed service offering) and large enterprises (segmented based on business units/groups)
– Separate access policy grouping for each virtual Edge Gateway
– Can have separate security administrators
– Master administrator control
Edge Gateway – v10.1 Features
69
Edge Gateway – v10.1 Features
• BIG-IP Edge Client– Web delivered and standalone– New look and feel– Mobility: Roaming and smart connection– QoS on Windows machines (client side)– Acceleration: Adaptive compression– SDK for integration
• Endpoint Security– Windows and Macintosh checks– Protected Workspace (Parity with FP 6.1)
with encryption and Virtual File System– Group policy integration– Virtual Keyboard
70
DMZ
4,000 Remote Users
15,000 Corporate Users
Internal LANVLAN 1
Internet
1,000 Wireless Users
Internal LANVLAN 2
Utilize existing user directory
Datacenter Resouces
6,000 Corporate Branch Users
Traditional SSL VPN (clustered 3 max)
$751K for 26k users
High Cost to Scale Remote Access
• Cost prohibitive scaling for remote access • Three-unit cluster supports 26k users at $29 per user • Asymmetric acceleration not available for remote
access• Limited QoS• User and application disruption when roaming
71
BIG-IP Edge Gateway: High Performance, Low Cost
DMZ
4,000 Remote Users
15,000 Corporate Users
Internal LANVLAN 1
Internet
1,000 Wireless Users
Internal LANVLAN 2
Utilize existing user directory
Datacenter Resouces
6,000 Corporate Branch Users
BIG-IP Edge Gateway
$188K for 26k users
25% of cost
• Consolidation: 3:1 on Access and Acceleration • High performance – 26,000 users at $7+ per user
• Scale up to 40,000 users• Flexible and centralized security policy management• Integrated endpoint security checking• Integrated application acceleration – up to 10x