Architecture: Consolidated Platform. Eddie Augustine Major Accounts Manager: Federal

Transcription

1 Architecture: Consolidated Platform Eddie Augustine Major Accounts Manager: Federal

2 Current DoD Situation Stovepipes of Technology icontrol Customization irules Solutions Security Access Availability Load Balancing App Acceleration WAN Opt DNSSEC VDI / BYOD IP v4 v6 App Security SSL VPN CAC / SSO Traffic Management Operating System (TMOS) Application Delivery Services F5 Networks, Inc 2

3 Elimination of Stovepipes icontrol Customization irules Security Solutions Access Availability Traffic Management Operating System (TMOS) Application Delivery Services This is not a product pitch but rather an ARCHITECTURE conversation F5 Networks, Inc 3

4 Benefits of a Consolidated Platform - Reduced infrastructure = LOWER COST - Reduced personnel / SMEs = LOWER COST - Standardization = LOWER COST - Less power (multiple devices) = LOWER COST - SSL Offload = LOWER COST - Less training = LOWER COST - Lower maintenance fees = LOWER COST - Faster delivery of apps = Happier Users - Context aware = MORE SECURE (W,W,W,W,W, H) F5 Networks, Inc 4

5 Application Delivery Networking App Access Management Paul Deakin FSE

6 Application Complexity: Extending Beyond the Code Growth Availability End-user Experience Application Architect Security Efficiency F5 Networks, Inc 6

7 Corporate Employees Mobile Employees Remote Employees Branch Employees Customer, Partners, or Suppliers How do I connect all these applications and services to the right people, at the right moment in time, using the right amount of resources, meet all my SLAs, ensure security and save money? Cloud Services Hosted Applications Corporate SAAS Data Center Branch Apps and Data F5 Networks, Inc 7

8 F5 s Strategic Point of Control Users Availability Optimization Security Management Scale HA / DR Bursting Load-Balancing Network Application Storage Offload Network Application Data Access Integration Visibility Automation Orchestration Resources APP OS APP OS APP OS APP OS APP OS APP OS APP OS APP OS Private Public Physical Virtual Multi-Site DCs Cloud

9 Corporate Employees Mobile Employees Remote Employees Branch Employees Customer, Partners, or Suppliers A Modern IT Delivery Model Cloud Services Hosted Applications Corporate SAAS Branch Apps and Data Center Data F5 Networks, Inc 9

10 Application Authentication : 3 Common (Static) Models Proxy 3 Web Servers 2 1 App 1 In the Code? App 2 App 3 In an Agent? App n Policy Manager Directory In a Proxy? F5 Networks, Inc 10

11 Application Authentication : Another Virtualized Service! Web Servers App 1 Reduce Cost App 2 App 3 Gain Scalability App n Policy Manager Directory Increase Security F5 Networks, Inc 11

12 Credential Caching and SSO Unified Access Control One Authentication Multiple Access Credential Caching colab.ex.com Client ex.com Auth Virtual CC Virtual CC Virtual support.ex.com F5 Networks, Inc 12

13 Federal Gov t Authentication Complications Explosion of smart cards: Federal Govt's CAC card Extra auth. infrastructure required for Kerberos protocol Orgs. are required to federate between agencies Additional auth. costs $1M to $5M per agency ADC Auth. Gateway Kerberos granting ticket Users from different agencies accessing federated sites F5 Networks, Inc 13

14 Simplified Smart Card Authentication Tier Reduce infrastructure costs bringing auth. to BIG-IP Integrate and distribute users to domains Easier deployment throughout agencies Trusted Proxy Kerberos granting ticket Token based client access card for mobile users F5 Networks, Inc 14

15 Edge Authentication Web Servers App 1 Endpoint Control App 2 App 3 Location Awareness App n Policy Manager Directory Flexible Authentication F5 Networks, Inc 15

16 Authentication on the Edge! Greater Client Control Decisions and Services Applied Earlier Clients Applications F5 Networks, Inc 16

17 Graphical Access Policy Management F5 Networks, Inc 17

18 Increased Situational Awareness F5 Networks, Inc 18

19 Virtualization Support Built In F5 Networks, Inc 19

20 Software Modules

21 BIG-IP Local Traffic Manager Direct traffic to the best available server Guarantee application availability Available Load balancing Health Monitor Server Persistence Fast Compression RAM Caching TCP Multiplexing Secure DDoS protection TCP proxy Application proxy SSL offload

22 BIG-IP Global Traffic Manager Direct, secure, and scale your DNS infrastructure Scale DNS Up to 20 million queries per second IP Anycast for increased resilience Automated configuration sync Client L-DNS Secure DNS BIG-IP GTM DDoS protection DNS protocol validation End the BIND patching cycle Direct DNS Load balance across data centers Direct to physical and cloud DCs Geographic IP topology database BIG-IP LTM App Servers Data Center 1 BIG-IP LTM App Servers Data Center 2

23 Security Landscape Network Threats Application Threats 90% of security investment focused here Yet 75% of attacks are focused here Attack Vectors TCP SYN Flood TCP Conn Flood DNS Flood HTTP GET Flood Attack Vectors HTTP Slow Loris DNS Cache Poison SQL Injection Cross Site Scripting Source: Gartner

24 F5 Extends Security Across All Layers BIG-IP Advanced Firewall BIG-IP Application Security Data Link 2 Network 3 Transport 4 Session 5 Presentation 6 Application 7 EAL 2+, EAL4+ in process

25 F5 mitigation technologies F5 Mitigation Technologies DDoS MITIGATION Increasing difficulty of attack detection OSI stack Physical (1) Data Link (2) Network (3) Transport (4) Session (5) Presentation (6) Application (7) OSI stack Network attacks Session attacks Application attacks SYN Flood, Connection Flood, UDP Flood, Push and ACK Floods, Teardrop, ICMP Floods, Ping Floods and Smurf Attacks DNS UDP Floods, DNS Query Floods, DNS NXDOMAIN Floods, SSL Floods, SSL Renegotiation OWASP Top 10 (SQL Injection, XSS, CSRF, etc.), Slowloris, Slow Post, HashDos, GET Floods BIG-IP AFM SynCheck, default-deny posture, high-capacity connection table, full-proxy traffic visibility, rate-limiting, strict TCP forwarding. Packet Velocity Accelerator (PVA) is a purpose-built, customized hardware solution that increases scale by an order of magnitude above software-only solutions. BIG-IP LTM and GTM High-scale performance, DNS Express, SSL termination, irules, SSL renegotiation validation BIG-IP ASM Positive and negative policy reinforcement, irules, full proxy for HTTP, server performance anomaly detection Protect against DDoS Withstand the Gain visibility and at all layers largest attacks detection of SSL F5 Networks, Inc encrypted attacks 25

26 BIG-IP Security Use the right tool Next generation firewall F5 Application Delivery Firewall Corporate (users) Characteristics Outbound user inspection UserID and AppID Who is doing what? 1K users to 10K websites Broad but shallow SEPARATION OF FIREWALLS Internet data center (servers) Characteristics Inbound application protection Application delivery focus 1M users to 100 apps Narrow but deep 12 protocols (HTTP, SSL, etc.)

27 Network Floods Mitigated by Scale and Performance VIPRION 4800: 288M concurrent sessions VIPRION 4480: 144M concurrent sessions VIPRION 2400: 48M concurrent sessions BIG-IP 10200v: 36M concurrent sessions Layer 4: SYN-flood protection in hardware, mitigating 1 billion SYNs per second Layer 3: Configurable rate-limiting of ICMP floods

28 Millions BIG-IP Advanced Firewall Full Network Firewall Integrated into the ADC Advanced Firewall Layer 2 4 Protection Application-centric deployment Massive Scale for DDoS Protection ICSA Certified Network Firewall Integrated into the BIG-IP ADC Connections per second x F5 VIPRION 4480 Juniper SRX 5800 Cisco ASA 5585-X Check Point 61000

29 BIG-IP Application Security Secure web applications from threats Application Security Layer 5 7 Application Protection PCI DSS Compliance Positive + Negative Security Models ICSA Certified Web App Firewall Integrated into the BIG-IP ADC Automate Signature Updates Industry Partnerships Users BIG-IP ASM Web Applications

30 BIG-IP Access Policy Manager Identify, authenticate, and control user access to your applications Secure and accelerate application access from any device and location Consolidate AAA and SSO services for enterprise applications RDP, View, Citrix Xen Support Federate via SAML Single Sign On Mobile User Access Scalable SSL VPN Advanced Endpoint checks BYOD: IOS, Win8, Android Support

31 BIG-IP Web Accelerator Acceleration for static and dynamic web apps Page Load Time Page Generation Time Page Delivery Time Page Generation Time Client Browser Server Infrastructure Network Acceleration Compression Dynamic Caching TCP Express Differential Compression QoS Security/authentication Compression Dynamic Caching Content Spooling OneConnect Rate Shaping Connection limit Server Offload

32 BIG-IP Wan Optimization Module Connection is encrypted and accelerated via network and application proxies, compression, de-duplication Migrate live VM images across WAN without dropping user sessions Accelerate replication and backup such as SnapMirror or Exchange Data center to data center acceleration Data Center 1 Data Center 2 BIG-IP TCP & HTTP Optimization Web Tier BIG-IP App Tier Internet or WAN Optimization of applications such as HTTP BIG-IP / ARX Optimization of data replication and backup. Active Database File Servers Logical Diagram Standby Database File Servers This is a logical diagram. Database and storage acceleration will physically route through the BIG-IP.

33 Enterprise Manager Centralized Manager for BIG-IP Products Reporting Predefined reports User generated reports Exportable (pdf, csv, ) Views Node/Pool Member Views Easy access for Enable/Disable Software Upgrades Stage upgrade packages to target BIG-IPs Schedule BIG-IP software upgrades Manual or automatic activation of upgrades Backups Schedule automated config backups Run visual diffs against current configs Heuristics Ability to connect to heuristics engine Ability to schedule heuristics run

34 Thank You! F5 Networks, Inc 34