Citrix NetScaler Basic and Advanced Administration Bootcamp

Transcription

1 Citrix NetScaler Basic and Advanced Administration Bootcamp Duration: 6.00 Days Course Code: NETBC Overview: This boot camp covers the initial configuration and administration of Citrix NetScaler 9.2. You will gain an understanding of NetScaler features such as load balancing, SSL offload, classic and advanced expressions, rate limiting, and AppExpert templates. Interactive instructor-led discussion and hands-on labs and exercises guide you through administrator tasks, preparing you to manage Citrix NetScaler 9.2 deployments and provide the foundation to manage, configure and monitor advanced features and components of Citrix NetScaler 9.0 Platinum Edition. Interactive discussion and hands-on labs guide learners through advanced administration tasks such as troubleshooting, configuring application security with the Citrix Application Firewall feature, tuning the NetScaler for high traffic, configuring Authentication Authorization and Accounting for system management, and configuring Advanced Policies using service callouts. Advanced monitoring and management tasks such as configuring and using EdgeSight for NetScaler, Command Center, and NetScaler Web Logging are also covered. Prior NetScaler knowledge is strongly recommended. Objectives: Upon successful completion of this course, learners are able to complete the following: Identify common web attacks and vulnerabilities Write PERL compatible regular expressions Configure Citrix Application Firewall 9.0 to protect web applications Troubleshoot Citrix Application Firewall 9.0 Install and configure Citrix EdgeSight for NetScaler to monitor web application performance Install, configure, and use Citrix Command Center to manage NetScaler devices Configure and use additional advanced features of NetScaler 9.0 including NetScaler Web Logging, HTTP Callout, and AAA authentication for web applications Deployment considerations and network placement options Perform an initial configuration NetScaler-owned IP addresses Configure virtual local area networks (VLANs) Configure reverse network address translation (RNAT) Configure access control lists Configure SSL offload Configure NetScaler features using classic policy expressions, including: Content filtering Content switching Compression Perform auditing and logging Perform monitoring Configure global server load balancing (GSLB) Configure NetScaler features using advanced policy expressions, including: Rewrite Responder URL transformation Integrated caching Configure rate limiting Configure AppExpert templates Troubleshoot NetScaler configurations Configure high availability

2 Configure load balancing Prerequisites: Before taking this course, Citrix recommends that learners have the following knowledge and experience: Experience with configuring NetScaler systems, including an understanding of services, virtual servers, and policies Experience with network devices, such as routers and switches, various networking protocols and aspects of application and site architectures (such as DMZs and VLANs) Understanding of concepts related to monitoring and management including basics of SNMP Attended one of the following courses o CNS-200-1I - Basic Administration for Citrix NetScaler 9.0 o NS-BOA Citrix NetScaler Basic Operations and Administration o CTX-1730 Citrix NetScaler: Basic Operations, and CTX-1731 Citrix NetScaler: Administration o Or, equivalent experience with Citrix NetScaler version 6.1, 7.0, 8.0, 8.1 or 9.0 Intermediate knowledge of TCP/IP and HTTP protocols and an understanding of the OSI model Experience with network devices such as routers and switches, various networking protocols, and aspects of application and site architecture such as DMZ and VLANS Moderate exposure to UNIX or Linux Exposure to basic systems administration concepts, including logging, software upgrade procedures, and high availability operations Familiarity with web server software such as Apache, IIS, or WebSphere Basic knowledge of DNS, SSL, and compression concepts Understanding of concepts related to server load balancing and content switching Knowledge of network security threats and site protection concepts such as firewalls, worms, DDoS attack

3 Content: This BootCamp is a combination course of two o Profiles o Surge Queue courses (Basic Administration for Citrix o Surge Protection NetScaler 9.2 (CNS-203)) and (Advanced Profile Types Administration for Citrix NetScaler 9.0 Default Profiles Request and Response Rates (CNS-300-2I)) Creating a Profile in the Configuration Throttle Rate Utility Disabling Surge Protection in the Creating a Profile in the Command-Line Configuration Utility 1.Deploying Citrix NetScaler Interface Disabling Surge Protection for a Service in Action Settings the Configuration Utility NetScaler Request Switching Sessionization and Security Checks Setting Thresholds in the Configuration Product Features Profile Settings Utility NetScaler 9.0 Enhancements Error Page Product Editions HTML Comment Stripping o Priority Queuing Hardware Platforms XML Error Object Hardware Components Other Profile Settings Enabling Priority Queuing in the Deployment Scenarios Configuration Utility Deployment Considerations o Policies Creating a Priority Queuing Policy in the Network Placement Options Configuration Utility Policy Creation Binding Priority Queuing Policies in the 2. Performing an Initial Configuration Policy Binding Configuration Utility Policy State Weighted Queuing Management Connectivity Policy Priorities NetScaler Administrative Tools Creating a Policy in the Configuration Using the Configuration Utility Utility o HTTP Denial-of-Service Protection Using the Creating Policies in the Command-Line Monitoring the NetScaler System Interface Enabling HTTP DoS Protection in the Managing System Functions through Binding and Prioritizing a Policy in the Configuration Utility FreeBSD Configuration Utility Adding a HTTP DoS Policy in the Using Third-Party Tools Binding Policies in the Command-Line Configuration Utility NetScaler System Installation Interface Challenged JavaScript Responses Logging in to the NetScaler System Client Detection Tuning and JavaScript Setting up the NetScaler System Challenge Response Rate Changing the Password o Engine Settings HTTP DoS Protection Deployment Performing Initial Configuration Guides Saving the Configuration Regular Expressions Attack Characteristics Enabling Network Time Protocol NetScaler Management o Regular Expressions Performing an Upgrade o Forms of Regular Expressions o IP Rate Limiting Managing Licensing o Using Regular Expressions Enabling NetScaler Features o Metacharacters and Literal Characters Rate Control by Subnet Example Managing Role-Based Administration o Metacharacters IP Rate Limiting Best Practices NetScaler System Communication o Escapes Authentication, Authorization, and Auditing Security Management o Quantifiers Securing Internal Services o Backreferencing o Users, Groups and Command Policies Configuring Secure System Access o Lookaheads o Regular Expression Scope Authentication, Authorization, and Auditing 3. Networking Systems and AAA Users Groups Attacks and Protections Local Accounts Introduction to NetScaler Networking External Authentication NetScaler-Owned IP Addresses o Security Checks Routing Traffic Using Layer 3 Mode o External Authentication for System Users Switching Traffic Using Layer 2 Mode Profile Types Sending a Client IP Address to Servers Common Security Checks Authentication Actions and Policies Virtual Local Area Networks HTML Security Checks Configuring Local Authentication Network Address Translation XML Security Checks Configuring External Authentication with Configuring Reverse Network Address Request-Side and Response-Side Explicit Accounts Translation Checks Configuring External Authentication with Access Control Lists Group Extraction Configuring Access Control Lists Creating an External Authentication Policy Link Aggregation Control Protocol o HTTPS Web Applications Creating local groups in the o Buffer Overflow Exploits 4. Configuring High Availability Binding Groups in the Command-Line Goals of a Buffer Overflow Attack Interface High Availability Overview Consequences of a Buffer Overflow Creating an LDAP Authentication Action in

4 High Availability Node Configuration Attack the Configuring Nodes Creating an Authentication Policy in the Verifying High Availability Status Propagation and Synchronization o Buffer Overflow Protection Binding the Policy in the Command Line Performing a Forced Failover Interface High Availability Management Default Maximum Values Authentication Troubleshooting Failover Interface Set Modifying Buffer Overflow Settings External Authentication Common Issues 5. Configuring Load Balancing o Parameter Manipulation o AAA for Traffic Management Load Balancing Topology Entity Management Parameter Manipulation Example Enabling AAA for Traffic Management Creating Servers AAA for Application Traffic Creating Services Basic AAA Setup for Application Traffic Creating Virtual Servers o Server Misconfiguration Workflow for AAA Traffic Management Creating Entity Templates o Deny URL Protection Service Monitoring Identifying Monitor Parameters The Deny URL List o Configuration Performing HTTP Monitoring Adding a Deny URL in the Load-Balancing Methods Creating an Authentication Virtual Server Service Weights Deleting a Deny URL in the Creating an Authentication Virtual Server Entity Binding in the Session Persistence Binding an SSL Certificate in the Other Load Balancing Options Other Load Balancing Methods o SQL Injection Binding a Virtual Server to an Load Balancing Visualizer Authentication Policy in the How SQL Injection Works 6. Monitoring and Maintaining Load Balancing Configuring a Virtual Server to use an o HTML SQL Injection Protection Authentication Virtual Server in the Load Balancing Traffic Types Extended Content Verification (ECV) SQL Keywords and Special Characters Configuring Authorization Policies for Monitors Modifying SQL Injection Action Settings Traffic Management Performing HTTP-INLINE Monitoring XML SQL Injection Security Check Setting the Default Traffic Management Setting Monitor Thresholds Cross-Site Scripting Authentication Action to Deny in the Token and Hashing-Based Load Balancing Attacking the Trust Relationship Configuring Load Monitors How Cross-Site Scripting Attacks Work Creating an Authorization Policy to Allow Service and Virtual Server Management Results of a Cross-Site Scripting Attack Access Troubleshooting Load Balancing Preventing Cross-Site Scripting Attacks HTML Cross-Site Scripting Protection 7. Configuring SSL Offload Cross-Site Scripting Action Settings o Audit Logging Transform Cross-Site Scripts SSL and Digital Certificates Check Complete URLs for Cross-Site Audit Logging Troubleshooting SSL Offload Scripting HTTP Service Callouts Server Certificates Additional Action Settings SSL Deployment Decisions Relaxations Deploying Front-End SSL with Back-End Modifying Cross-Site Scripting Action o HTTP Callouts HTTP Settings o Configuring HTTP Callouts Deploying Front-End SSL with Back-End Adding a Cross-Site Scripting Relaxation SSL Using the Configuring HTTP Callouts in the Deploying Front-End SSL_TCP with Deleting a Cross-Site Scripting Configuration Utility Back-End TCP Relaxation Using the Command-Line Configuring HTTP Callouts in the Deploying SSL_BRIDGE Interface SSL Administration XML Cross-Site Scripting Security Check Callout Examples Generating a Key HTTP Callout Response Parsing Generating a Certificate Signing Request o Command Injection Generating a Certificate for Testing Creating a Certkey Command Injection Examples o HTTP Callout Use Cases Binding a Certkey Advanced SSL Settings o Field Format Protection Scenario 1: Filter Clients Based on an IP Address Blacklist 8. Configuring Content Filtering Using Classic Field Types and Field Formats Scenario 2: Fetch and Update Content Policies Predefined Field Types HTTP Callout Auditing Custom Field Types EdgeSight for NetScaler Policy Basics Field Format Configuration HTTP and HTTPS Traffic Default Field Format o Data Flow Overview Expression Structures Confidential Fields o JavaScript Response Injection.

5 Qualifiers, Operators, and Expression Adding a Custom Field Type Values Setting a Default Field Type User Metrics Simple Expressions Modifying Field Format Settings NetScaler Metrics Compound Expressions Adding a Confidential Field NetScaler Metric Example Content Filtering Basics Modifying a Confidential Field Data Validity Filter Actions Configuring Content Filtering o Cookie Tampering and Poisoning Binding Filters o EdgeSight for NetScaler Server Types of Cookies Components 9. Configuring Content Switching How Cookies Are Added Web Server Sessions Component Installation Scenarios Content Switching Overview Content Switching Virtual Servers o Cookie Consistency Protection o EdgeSight for NetScaler Installation Content Switching Policies Considerations Binding Content Switching Policies Sessionization and Cookies Relaxations Installing EdgeSight for Netscaler 10. Configuring Compression Adding a Cookie Consistency Relaxation SQL Server in the SQL Reporting Services Basics of Compression Deleting a Cookie Relaxation in the EdgeSight for NetScaler Components Compression Parameters Installing EdgeSight Database Compression Policies Components Configuring Compression Policies Installing EdgeSight Report Console and o Form/Hidden Field Manipulation Data Collector Components 11. Auditing and Logging EdgeSight Post-Installation Wizard Example of Hidden Field Manipulation Upgrading EdgeSight for NetScaler Syslog and Nslog Auditing Configuring Audit Servers o Reporting Services Initial Configuration Configuring Global Auditing Parameters o Form Field Consistency Protection Configuring Auditing Policies NetScaler Configuration Overview Binding Auditing Policies Field Consistencies Configuring HTML Injection Viewing Audit Messages User Sessions Editing the prebody.js script NetScaler Log Management Adding a Form Field Consistency Configuration Example in the Relaxation Using the Command-Line 12. Monitoring Interface Add NetScaler System to EdgeSight for Deleting a Form Field Consistency NetScaler Data Collector Simple Network Management Protocol Relaxation Using the Command-Line Topology Data Collectors with SSL SNMPv1 and SNMPv2 Interface Configuring SNMP Managers Configuring the MIB System Variables o EdgeSight Charts and Reports Configuring SNMP Community Strings o Forceful Browsing o EdgeSight Troubleshooting Configuring SNMP Traps Configuring SNMP Alarms Forceful Browsing Protection Troubleshooting OS Components SNMPv3 Troubleshooting HTML Injection Dashboard Troubleshooting Injection Request Dashboard Components o Start URLs Troubleshooting Unknown Device Navigating the Dashboard Troubleshooting from the NetScaler Customizing the Built-In Comparative Charts The Start URL List Pane Sessionization and Start URLs Command Center Customizing the Group Monitoring Pane Modify Start URL Check Reporting Tool Adding a Start URL in the Command-Line o Command Center Introduction Monitoring Tool Interface Deleting a Start URL in the Command Center NetScaler Features 13. Configuring Global Server Load Balancing NetScaler and WANScaler Support GSLB Concepts Defining Metric Exchange Protocol o Backdoors and Misconfigurations o Command Center Clients Communication o URL Closure GSLB Persistence Connecting to Command Center GSLB Site Affinity Enforcing URL Closure in the DNS Concepts Configuration Utility o Server Requirements Configuring DNS Virtual Servers Enforcing URL Closure in the Configuring Service Type DNS Disk Space Requirements Authoritative DNS Service MySQL Considerations GSLB DNS Response Options Microsoft SQL Server 2005 Considerations GSLB Configurations o Identity Theft Attacks Implementing Traditional GSLB

6 Implementing GSLB Failover for Disaster Types of Identity Theft Attacks o Port Setting Requirements Recovery Application Firewall Protection Against Implementing Proximity-Based GSLB Identity Theft Command Center Installation Configuring GSLB (Command-Line Linux Considerations Interface) o Credit Card Protection Installation Configuring GSLB Services (Configuration Capacity Planning Utility) Predefined Credit Cards Backup Configuring ADNS Credit Card Settings Installation Modes Synchronizing GSLB Configurations Installation Considerations Automatically o Protecting Credit Cards 14. Using Advanced Policies o Command Center Functionality Protecting Credit Cards in the NetScaler Policy Overview Configuration Utility Command Center Home Page Packet Processing Flow Protecting Credit Cards in the Discovery Policies Fault Management Advanced Policy Expressions Configuration Management Advanced Policy Expression Syntax Change Management Actions o Errors Triggering Sensitive Information Centralized Certificate Management Policy Bindings Leaks Performance Monitoring Bind Points o Safe Object Protection Using the Policy Manager Policy Labels Defining a Safe Object o Command Center Administration Using Pattern Sets Adding a Safe Object Typecasting Adaptive Learning for Security Security Administration Learning Over Time Administration Operations 15. Configuring Rewrite, Responder, and URL Learning Thresholds Administration Configuration Transformation Generalized and Simple Rules Server Details Learned Rules Rewrite, Responder, and URL Enabling Learning Transformation Overview Setting Learning Thresholds o Command Center Troubleshooting Packet Processing Flow Managing Learned Rules Basic Configurations: Policies and Actions Application Firewall Troubleshooting Microsoft SQL Database Issues Configuring Rewrite Actions Discovery Issues Configuring Rewrite Policies o Application Firewall and Applications Performance Data Issues Responder Actions Linux Access Configuring Responder Policies HTTP Headers Issues Configuring URL Transformation HTML Comment Stripping Reporting Issues Troubleshooting URL Transformation NetScaler Web Logging o Configuration Issues 16. Configuring Integrated Caching Policy Issues o NetScaler Web Logging Introduction Integrated Caching Architecture Profile Issues Static and Dynamic Content Suggested Actions Architecture Overview Request and Response Process Flow Queuing and Connection Tuning Communication Process Cache Policies Cache Policy Evaluation Making Graceful Configuration Changes o HTTP Connections o NetScaler System Configuration Cache Content Groups Controlling Content Aging Keep-alive HTTP Connections Enabling Web Logging in the Configuration Content Group Settings HTTP 1.0 and 1.1 Behavior Utility Enabling FlashCache Piped Requests Enabling Web Logging in the Setting Global Attributes Managing Caching Configuring the Buffer Size in the Caching Examples o HTTP Connection Management and Configuration Utility NetScaler HTTP Behavior Configuring the Buffer Size in the 17. Configuring Rate Limiting Client Keep-Alive Rate Control Connection IP Address Control Rate-Limiting Components Maximum Requests and Maximum o NSWL Client Installation Configuring Rate Control Connections Rate Control Policy Scenarios Connection Idle Settings Logging System Components Trackable Connections Installing the NSWL Client on Windows 18. Configuring AppExpert Templates NSWL Options o TCP Buffering Windows Service Registry Key AppExpert Templates

7 Using the Application Interface Down-State Flush and Access Down Planning for Applications Connection Settings o NSWL Client Configuration AppExpert Template Deployment TCP Optimization Viewing Application Template Statistics Advertised Window Size NetScaler IP Addresses Window Scaling Log Filters 19. Troubleshooting the NetScaler Selective Acknowledgement Defining Log Properties Running NSWL NetScaler System Overview Verifying the Configuration Logged Information Accessing Logged Information Network Traffic Capture o Troubleshooting Web Logging Statistics NSWL Troubleshooting Advanced Troubleshooting NetScaler Troubleshooting Buffer Overflow o Troubleshooting Resources Citrix Knowledge Center Citrix Product Documentation Citrix Technical Support Collected NetScaler Data Troubleshooting Log o NetScaler System Overview NetScaler Processes o ncore Configuration Architecture o Built-In Tools Nsconmsg Network Traffic Capture show and stat Commands Reporting Tool Shell Tools Tools Configuration Utility Tools o Third-Party Tools Network Protocol Analyzers Web Browser Plug-ins SNMP Browsers FTP Clients Introducing Application Firewall o Application Attacks Application Attack Description Goals of Application Attacks Most Common Types of Web Application Attacks The Application Firewall Solution Business Problems o The Benefits of Application Firewall Application Layer Protection Positive Security Model Negative Security Model Deep Stream Inspection Adaptive Learning Engine Web Application Vulnerabilities

8 Security Audits and Application Firewalls o Payment Card Industry Data Security Standard Importance of PCI Common Coding Vulnerabilities PCI-DSS Report Packet Processing and Inspection Request Process Response Process Deployment Considerations o Profiles and Policies Profiles Policies Profiles and Policies Further Information: For More information, or to book your course, please call us on (0) or training@globalknowledge.com.eg Global Knowledge, 16 Moustafa Refaat St. Block 1137, Sheraton Buildings, Heliopolis, Cairo