Unified Secure Access Beyond VPN

Transcription

1 Unified Secure Access Beyond VPN Luboš Klokner F5 Systems Engineer

2 Humans v. Technology F5 Networks, Inc

3 Agenda Introduction General APM Use-Cases APM Use-Cases from my territory F5 Networks, Inc 3

4 F5 Knows Application Access Authentication, authorization, and SSO to all apps, anywhere, anytime VDI / Virtual Apps Native VDI Secure Web Gateway Web Sites and Applications Web-based Apps Web Access Management Remote Access and Application Access Enterprise Applications Mobile Apps Virtual Edition Enterprise Mobility Gateway Appliance Chassis Identity Federation & SSO Cloud, SaaS, VDI & Partner Apps F5 Networks, Inc

5 Adapting access and authentication Users Adaptive Auth Federation (SAML) SSO Selection Endpoint Validation SAML Pass-through Simple Assertion Apps Token Kerberos Delegation Password Step-Up Auth Dynamic Forms Certificates Fraud Protection Certificates Private/Public Cloud Transform one type of authentication into another so an application may understand and use it without installing additional agents Allow flexible selection of SSO technique appropriate to F5 Networks, Inc

6 BIG-IP APM Unified access and control for BIG-IP Features Scales up to 2M users on a single device Centralizes single sign-on (SSO)/Federation and access control services Full proxy L4-L7 access control at BIG-IP speeds Adds endpoint inspection to the access policy Visual Policy Editor (VPE) provides policy-based access control Benefits Consolidates authentication infrastructure Simplifies remote, web, and application access control F5 Networks, Inc 6

7 BIG-IP APM Unified access and control for BIG-IP Features Scales up to 2M users on a single device Centralizes single sign-on (SSO)/Federation and access control services Full proxy L4-L7 access control at BIG-IP speeds Adds endpoint inspection to the access policy Visual Policy Editor (VPE) provides policy-based access control Benefits Consolidates authentication infrastructure Simplifies remote, web, and application access control F5 Networks, Inc 7

8 BIG-IP APM Unified access and control for BIG-IP Features Scales up to 2M users on a single device Centralizes single sign-on (SSO)/Federation and access control services Full proxy L4-L7 access control at BIG-IP speeds Adds endpoint inspection to the access policy Visual Policy Editor (VPE) provides policy-based access control VPE Rules programmatic interface for custom access policies Benefits Consolidates authentication infrastructure Simplifies remote, web, and application access control F5 Networks, Inc 8

9 Remote Access 2016 F5 Networks 9

10 Fast, Secure Remote Access User = HR Corporate domain HR Latest AV software Current OS AAA server F5 Networks, Inc

11 Federation/SSO

12 Identity Federation and SSO Different Clients On-Premises Infrastructure Corporate Users Identity SAML Multi-factor management authentication Users Real-time SAML control access Access enforcement policy Access Management Attackers Office 365 Directory Services Corporate Applications Google Apps Salesforce Identity federation SaaS F5 Networks, Inc

13 Web Access

14 Secures and Manages Web Access User = CEO LAMP AAA server F5 Networks, Inc

15 Mobility

16 Enhances Enterprise Mobility HR User = Finance App Store Finance MDM AAA Server CRM F5 Networks, Inc 2016 F5 Networks 16

17 Use Cases

18 Federation SAML Web Access Web Interface ecommerce Cloud SP Developer A Redirection SAML Fed Authentication IdP Business Logic OTP Cookie Application Servers Developer B SMS GW LDAP / IAM Developer C

19 Kerberos Constrained Delegation Devices Authentication Kerberos Application BIG-IP Authenticate client (Username/password, Token, SMS, Certificate) BIG-IP retrieve a Kerberos ticket on behalf of client

20 Access Policy using SMS OTP OTP

21 Skype 4 Business 2016 F5 Networks 21

22 Skype 4 Business 2016 F5 Networks 22

23 Clientless mode authentication curl -k -u user1:user1 -v Virtual Server Application irule Parse request, find username/password Insert header to enable clientless mode Insert username/password in HTTP Header Respond with: 302 Redirect Location /vdesk/hangup.php3 Connection close # Enable clientless mode for client using basic auth if { [ exists "Authorization"] } { insert "clientless-mode" 1 insert "username" [ insert "password" [ }

24 FDS Integration WebServices/iRule Web Services Fraud Detection System irule HTTP Super SIDEBAND Requestor Provides details about the client Gets client score Application Servers User Database 2016 F5 Networks 24

25 DevCentral AskF5/Support ihealth University For further assistance please, contact me:

26