NGF0401 Instructor Slides

Transcription

1 Advanced Site to Site VPN Barracuda NextGen Firewall F VPN Tunnel Routing Separate routing table Default behavior Uses source based routing Creates separate premain routing tables for every VPN tunnel Single routing table Routes are inserted into the main routing table VPN routes are inserted with a preference of 10 Separate Routing Table Site 1 Site 2 VPN Tunnel Routing Forwarding Firewall VPN Host Firewall Protocol:Port TCP/UDP:691 Host Firewall VPN Forwarding Firewall Routing Client ( ) Server ( ) 1

2 Graphical Tunnel Interface (GTI) Editor Graphical interface to create and manage TINA and IPsec VPN tunnels Eliminates redundant configuration steps Configure VPN tunnels quickly Less error prone Requires a Control Center GTI Editor Transport IP configuration Reasons for different transport IP addresses GTI Editor tunnel setup Encrypted VPN Tunnel Small Office Headquarters Internet Branch Office Transport IPs Transport source IP Transport listening IP Encryption Domain <Transport Source IP> Outgoing <GTI Networks> <Transport Listening IP> Incoming Internet ( /0) 2

3 Why two different transport IPs? /24 <GTI Networks> Private Transfer Network ( /24) <Transport Source IP> <Transport Listening IP> Public IP Internet ( /0) GTI Editor Tunnel Setup Encryption Domain HQ Active Partner VPN Tunnel Passive Partner Encryption Domain BO <GTI Networks> <Transport Source IP> Internet <Transport Listening IP> <GTI Networks> Hub and Spoke VPN Relay BO /24 HQ /24 Internet ( /0) BO /24 3

4 Dynamic Mesh Fully meshed VPN network with on demand dynamic tunnels directly connecting remote firewalls Reduces number of active tunnels on the remote firewalls Dynamic Mesh Requirements VPN relaying with TINA using IPv4 IP addresses VPN hub must be able to determine the public IP of the spokes An access rule on the TI master must trigger the dynamic tunnel VPN hub must be TI master Spokes must be TI slaves Dynamic mesh must be enabled on each firewall Dynamic Mesh with TI Dynamic tunnels create a single bulk and quality transport Only if transport class is used on either firewall 4

5 Dynamic Mesh Limitations Traffic shaping must be applied to the interface, not TI transport Cannot be used in combination with WAN optimization Dynamic tunnels are not synced to the HA partner VPN tunnel start/stop scripts are not executed Connecting Two Identical Networks Routed VPN Network Handles failover scenarios not covered by Traffic Intelligence Tunnel is configured with VPNR interfaces Use the same index for all firewalls Assign unique IP addresses from an intermediary network to the VPNR interfaces Use IP addresses assigned to VPNR interfaces as gateways Routing lookup decides which tunnel is used When a tunnel goes down, metric is set to for that route Traffic sent via backup route with lower metric 5

6 Static Routing over Routed VPN Dynamic Routing over Routed VPN BGP or OSPF used to learn the remote networks automatically Used instead of static gateway routes Support for multicast addressing for OSPF Site to Site VPN Using IPv6 Supports IPv6 for the VPN envelope Not supported: Dynamic Mesh L2TP PPTP SSL VPN 6

7 WAN Optimization Significantly reduces site to site VPN network traffic Traffic compression varies according to type of network traffic More efficient for homogenous network traffic Limitations IPv4 and TCP only Does not work for encrypted traffic Not in combination with web log streaming Not in combination with SSL Interception Not in combination with Virus Scanning and ATP in the Firewall Data Deduplication When traffic is deduplicated, it is cached on both sides of the VPN tunnel and, if possible, delivered from the cache. WAN Optimization Policies Defined per protocol Combination of data deduplication and compression 7

8 Traffic Intelligence Barracuda NextGen Firewall F Introduction to Traffic Intelligence Multiple VPN Tunnels Between Two Locations Multiple VPN tunnels can lead to routing issues Duplicate Routes Local Network: /24 Remote Network: /24 Local Network: /24 Remote Network: /24 8

9 Multi Transport VPN Multi transport VPN instead of multiple VPN tunnels VPN Transport Class IDs Each VPN transport class is made up of eight class IDs (0 7), which define the VPN transport cost Bulk Quality Fallback TI Class TI ID Learning Policy 9

10 Learning Policy Routing Transports Payload not encapsulated or encrypted Use only when additional encryption is not required On Demand Transports TI Policy for Mail Preferred Transport Class: Bulk0 Second Try Transport Class: Quality2 Further Tries Policy: Stay on transport 10

11 On Demand Transports TI Policy for ERP Preferred Transport Class: Quality2 Second Try Transport Class: Further Tries Policy: First try Cheaper then try Expensive Explicit Transport Selection Preferred and Second Try transport class Further Tries transport selection policy Dynamic Transport Selection Dynamic Bandwidth and Latency Detection Performance Based Transport Selection Adaptive Bandwidth Protection Traffic Duplication 11

12 Dynamic Bandwidth and Latency Detection Initial active probing Bandwidth, latency, and drop rate are determined for each transport Monitoring Detects decreasing bandwidth Passive probing Detects increases in available bandwidth Active reprobe A repeat of the initial active probe Dynamic Bandwidth and Latency Detection Active probing and passive monitoring All probing and monitoring features are used to determine the link quality metrics. Active probing only The initial active probe and the hourly active reprobe are used to determine the link quality metrics. No probing The estimated bandwidth entered by the admin in the VPN tunnel configuration is used. Dynamic Bandwidth and Latency Detection Required for Adaptive Bandwidth Protection and Adaptive Session Balancing Cannot be used in combination with TCP, ESP, or hybrid transport protocols Dynamic Mesh VPN is not supported 12

13 Performance Based Transport Selection Selects the optimal transport based on: Latency Inbound or outbound bandwidth Combined bandwidth Adaptive Bandwidth Protection Ensures that NoDelay traffic is always prioritized QoS bands are used to differentiate between NoDelay and standard traffic Adaptive Bandwidth Protection Internal traffic shaping distinguishes between NoDelay and standard traffic Dynamic Bandwidth and Latency Detection metrics ensure full utilization of the available bandwidth NoDelay and standard traffic are continuously adjusted to match link quality metrics Combined traffic: 90% for NoDelay and 10% for standard traffic guaranteed Single traffic: up to 100% for NoDelay or up to 70% for standard traffic 13

14 Traffic Duplication Sends packets simultaneously through the primary and secondary transport Both traffic streams are combined on the receiving site of the VPN tunnel. Allows instant failover without a single dropped packet Both transports must have the same bandwidth and latency. Static Session Balancing Distributes sessions via round robin over selected transports Without regard to the available bandwidth Same bandwidth recommended for all transports Packet Balancing Traffic is balanced with a round robin balancing policy on a perpacket basis Requires transports with the same latency and bandwidth 14

15 Adaptive Session Balancing Uses link quality metrics collected by Dynamic Bandwidth and Latency Detection Initial session balancing Rebalances sessions with a lifetime over 5 seconds Adaptive Session Balancing Balancing occurs between primary and secondary transport Rebalancing occurs continuously Always selects the optimal transport Can be combined with Adaptive Bandwidth Detection Standard traffic uses the second best transport if NoDelay traffic saturates the best available transport Supported only for UDP transports Traffic Intelligence with Dynamic Mesh Dynamic tunnels create a single bulk 0 and quality 0 transport Only if transport class is used on either firewall Dynamic bandwidth and latency detection is not supported 15

16 Traffic Shaping (QoS) Barracuda NextGen Firewall F Traffic Shaping Usage Scenarios Traffic Shaping Usage Scenarios 16

17 Traffic Shaping with Virtual Interfaces Virtual interfaces reduce throughput to available bandwidth The router s queue should never be used Virtual Interface 10 Mbit/s Network Queue 1 Gbit/s 100 Mbit/s 10 Firewall ISP Router Mbit/s Internet Traffic Shaping Features and Goals Data traffic classification Prioritization Bandwidth partition Network overflow protection Dynamically adjusted shaping Shaping of VPN transports Traffic Classification 17

18 Traffic Shaping for VOIP Data QoS Bands The QoS band selected in an access or application rule determines the traffic shaping policy that is applied when the rule matches. QoS bands determine which virtual interface traffic is sent to For custom QoS bands: Ensure default rule settings still work IDs 1, 2, and 3 are the default bands used in the Host Firewall rules QoS Bands 18

19 Overview of Traffic Shaping Elements Parameterization Classification Enforcement Delivery Firewall Rules QoS Bands QoS Profile Port1 linked to assigned to is mapped QoS Profile with Sub Interfaces Virtual Sub Interface Operation Modes Shape The virtual interface limits traffic according to the outbound settings Priority Packets are passed through the shaping tree without being queued on the next interfaces (No Delay) Drop Packets are discarded Passthrough Packets are passed to the next tree node or to the associated network interface 19

20 Operation Mode: Shape with Bandwidth Limits Operation Mode: Priority Operation Mode: Drop 20

21 Operation Mode: Passthrough QoS Band Rules and Conditions QoS bands can have multiple rules Rule matching is based on conditions QoS band rule matches if all specified conditions apply: Traffic limit (amount of data per session) Time period Weekday/Hour TOS value Rules are processed sequentially on a first match basis QoS with 3rd Party Devices Adjust the QoS band with QoS band rules based on the TOS flag of the packet TOS flag can be modified in the Advanced settings of the access rule By default, the value is set to 0 (TOS unchanged) 21

22 QoS Policies and Application Control QoS band policies are set in the access rule QoS band can be overridden in application rules Application rules allow you to change QoS band based on: Application File content policy URL category Different QoS bands can be assigned based on the direction Forward and reply The Default QoS Profile 1: Interactive C1 C2 C3 NO C1 C2 C3 NO Dela NoDelay = 90% Dela y LowPrio = 5% Op. Mode=Priority y Increase class by 2 3: Business 5: Background 4: Internet 2: VOIP Virtual Interface Virtual Interface Virtual Interface Virtual Interface C1 C2 C3 NO Dela Choke = 0,1% y Virtual Interface Virtual Interface 8: Choke 6: LowPrio 7: LowestPrio Virtual Interface C1 C2 C3 NO Dela Root = 100% y Virtual Interface Network Interface Guidelines for QoS Usage Start with the predefined QoS profile Adjust shaping on new access rules Use the QoS bands VoIP and Interactive with care New access rules are assigned to band ID2 Limit number of virtual interfaces Shape all traffic for a physical interface 22

23 Traffic Shaping for VPN Traffic To shape VPN tunnel traffic, use one of the following approaches: Consolidated Traffic Shaping Shape on the output network interface Transport based Traffic Shaping Treat every VPN transport as a separate network interface No clear advantages or disadvantages Select the approach that is best for your specific scenario Consolidated Traffic Shaping Engine uses uncompressed data during the shaping process! Transport Based Traffic Shaping Challenge is to find proper bandwidth for each transport! 23