F5 Big-IP LTM Configuration: HTTPS / WSS Offloading

Transcription

1 F5 Big-IP LTM Configuration: HTTPS / WSS Offloading

2 Warning This document contains confidential information that is proprietary to CaféX Communications Inc. No part of its contents may be used, disclosed or conveyed to any party, in any manner whatsoever, without prior written permission from CaféX Communications Inc. Copyright 1/25/18, CaféX Communications Inc. All rights reserved. January 25, 2018 F5 Configuration HTTPS/WSS Offloading 1

3 Table of Contents 1 Document Control 3 2 Introduction 4 3 VLANs 5 4 SNAT 6 5 Self IP 7 6 Network Routes 8 7 Virtual Servers Health Monitor Virtual Server Pools HTTP Pool Properties HTTP Pool Members Media Pool Properties Media Pool Members Virtual Server Properties HTTPS Virtual Service with a HTTP backend Media Virtual Service HTTPS Virtual Service with a HTTPS backend Enabling WebSocket Profile in v Virtual Server Resources HTTP Virtual Server Media Virtual Server 21 8 irule - Restricting URI Access & Enabling Websockets Application URIs Fusion Web Gateway URIs Fusion Live Assist Server URIs Fusion Sample Application URIs Websocket URIs The irule 28 9 Contact information 31 F5 Configuration HTTPS/WSS Offloading 2

4 1 Document Control Version Author Issue Date Description / Change History 1.0 Solutions Engineering 26 September 2013 Initial Draft 2.0 Solutions Engineering 27 September 2013 Health monitoring added 3.0 Solutions Engineering 28 September 2013 irule updated 4.0 Solutions Engineering 30 September 2013 Media virtual server added 5.0 Solutions Engineering 03 October 2013 F5 issue SOL12938 referenced 6.0 Solutions Engineering 04 April 2014 Updated with reference to FCSDK Solutions Engineering 05 April 2014 Updated with reference to Palettes and Live Assist 8.0 Solutions Engineering 08 April 2014 Updated Live Assist irule URIs 9.0 Solutions Engineering 11 April 2014 Updated Live Assist irule and its allowable URIs 10.0 Solutions Engineering 28 May 2014 Updated with reference to Live Assist and Palettes Solutions Engineering 08 April 2016 Added notes for F5 v Solutions Engineering 24 January 2018 Added notes for F5 v12 and removal of Palettes F5 Configuration HTTPS/WSS Offloading 3

5 2 Introduction This guide walks through the configuration needed on F5 Big-IP LTM (Local Traffic Manager) to offload inbound HTTPS and Secure Websockets (WSS) requests. Note that since F5 BIG-IP v11 configuration is simplified. This document applies to previous versions and notes the differences to v11+. The environment this configuration relates to is: A non-ha Fusion Application Server (FAS) installation Fusion Client SDK (FCSDK) installed onto the FAS o o The FCSDK installation consists of a co-hosted Fusion Web Gateway instance and a Fusion Media Broker The FCSDK web-based sample application has been deployed onto this same FAS instance Fusion Live Assist installed onto the FAS The configuration described will terminate the HTTPS/WSS connection at F5, and will then NAT and load balance the decrypted connection across a pool of back end application servers. The configuration also describes the steps required to restrict specific URIs to only allow access to the required REST services for FCSDK and Fusion Palettes. Once the secure connection has been decrypted, F5 is able to translate the original source IP address of a packet to a configured IP address. This feature is known as Secure Network Address Translation (SNAT). The configuration illustrates how F5 can be configured to perform SNAT automapping i.e. enabling F5 to automatically choose a translation address which will be an existing Self IP address. The instructions in this guide are based on a non-ha evaluation version of F5 (v build 577) and should be used as an example of what configuration is required to achieve HTTPS/WSS offloading. As such, some configuration may vary depending on the local environment and policies. F5 Configuration HTTPS/WSS Offloading 4

6 3 VLANs Assuming F5 has 2 network interfaces (one for the public side and the other for F5 s private side), the following illustration defines 2 VLANs and associates appropriate interfaces with each. Note that in this environment, both network interfaces were untagged. F5 Configuration HTTPS/WSS Offloading 5

7 4 SNAT As SNAT automapping is being implemented, there are no SNATs explicitly defined. F5 Configuration HTTPS/WSS Offloading 6

8 5 Self IP A single Self IP address (from the Network > Self IPs menu) which is associated with F5 s private interface should be defined. It can be created by specifying the address, netmask and finally selecting the appropriate VLAN. F5 Configuration HTTPS/WSS Offloading 7

9 6 Network Routes A network gateway address is required to be created by specifying a particular router that the BIG-IP system should use when forwarding packets to the destination host or network. F5 Configuration HTTPS/WSS Offloading 8

10 7 Virtual Servers A virtual server must be created for each service exposed by F5. In the screenshots below, there is a service for handling HTTPS traffic and another for RTP traffic. As both FCSDK and Fusion Palettes are co-hosted on the same server, the configuration only defines one Virtual Server. 7.1 Health Monitor By default, the BIG-IP system uses HTTP 0.9 for HTTP monitor requests. When a HTTP 0.9 request is sent to a HTTP 1.1 server, the server may not respond as expected. Therefore, using the default HTTP health monitor may fail even though the server is running. To prevent the monitor from incorrectly marking the server as inaccessible, it is possible to either create a custom health monitor based on the default HTTP monitor or change the default HTTP monitor and change only its Send String property to send a HTTP 1.1 request by explicitly specifying the HTTP version as follows: GET / HTTP/1.1\r\nHost: \r\nconnection: Close\r\n\r\n This health monitor should be used when defining the back end server pool associated with the virtual server. In this example the name of the monitor is: fcsdk_http F5 Configuration HTTPS/WSS Offloading 9

11 7.2 Virtual Server Pools For each of the two services (HTTP and media), a group of member devices should be defined that will receive and process traffic. F5 Configuration HTTPS/WSS Offloading 10

12 Note that as SSL offloading is taking place, the back end server pool associated with the HTTPS Virtual Service is defined as being insecure HTTP Pool Properties A pool of backend servers is required to enable F5 to load balance the appropriate service. Note the use of the Health Monitor (fcsdk_http) created earlier. F5 Configuration HTTPS/WSS Offloading 11

13 7.2.2 HTTP Pool Members Although for simplicity this pool has only 1 member, there may be any number of members in a pool. When defining a member, along with its IP address, the port on which the service resides is also required. F5 Configuration HTTPS/WSS Offloading 12

14 7.2.3 Media Pool Properties The properties of the media pool are shown below. F5 Configuration HTTPS/WSS Offloading 13

15 7.2.4 Media Pool Members There is 1 Media Broker in the media pool as shown below. F5 Configuration HTTPS/WSS Offloading 14

16 7.3 Virtual Server Properties The NAT configuration of both the HTTPS and media Virtual Servers are as follows: Auto-SNAT is enabled meaning that F5 will automatically choose which address to translate the source IP into based on the list of Self IPs. o Following best practice, the name of the VLAN for which the virtual server is enabled has been changed from its default to being explicitly defined via the VLANs and Tunnels property HTTPS Virtual Service with a HTTP backend The virtual server has been configured with the following: The HTTP (not HTTPS) profile that is defined is the default HTTP profile without any changes. o In order for F5 to correctly process Websockets, the HTTP profile needs to be disabled via irules during the processing of the Websockets request, allowing the TCP communication to be proxied through the BIG-IP. irules will be discussed in a later section within this document. For the purposes of this exercise, F5 has been configured to use a client-side self signed certificate, and as such the SSL Profile (Client) property has been set to clientssl. o An alternative to this would be to import a CA signed certificate and define that in the SSL Profile (Client) property field. Note that the port exposed for the HTTPS service is defined here as being This should be configured to a value appropriate to the environment. F5 Configuration HTTPS/WSS Offloading 15

17 F5 Configuration HTTPS/WSS Offloading 16

18 F5 Configuration HTTPS/WSS Offloading 17

19 7.3.2 Media Virtual Service Other than the properties stated earlier, the media Virtual Server has been created using the default values. F5 Configuration HTTPS/WSS Offloading 18

20 7.3.3 HTTPS Virtual Service with a HTTPS backend In case there is a backend that is also HTTPS, it is expected that the F5 proxies also the SSL connection to the pool servers. In this case, the end client is presented with the certificates of F5, thus being hidden from the internal topology. It is possible to present the end client with each of the certificates of the servers behind the F5. This is not advised since private keys and certificates of internal elements will be stored on a public facing machine. Furthermore, it will reveal the internal topology To configure the F5 to proxy the ssl connections, one has to choose serverssl along with clientssl as the ssl profiles in the virtual server see the following image. F5 Configuration HTTPS/WSS Offloading 19

21 7.3.4 Enabling WebSocket Profile in v12+ WebSocket support is inherently in versions 12+. To secure applications that use WebSocket connections: Click Local Traffic > Virtual Servers Open the Virtual Server configuration Select the Advanced settings from the dropdown From the WebSocket Profile list, select websocket Once selected, save the changes by clicking Update The system uses the default WebSocket profile for the application F5 Configuration HTTPS/WSS Offloading 20

22 7.4 Virtual Server Resources HTTP Virtual Server The following shows the default load balancing pool associated with the HTTPS virtual server, which was defined earlier. Note that this is the insecure pool defined earlier Media Virtual Server The following screenshot shows the configured load balancing pool associated with the media virtual server, which was defined earlier. F5 Configuration HTTPS/WSS Offloading 21

23 F5 Configuration HTTPS/WSS Offloading 22

24 8 irule - Restricting URI Access & Enabling Websockets Access to application URIs can be restricted by defining an F5 irule associated with the virtual server. Define an irule (e.g. named FusionHttpsUriRule ) that will restrict access to specific URIs by only allowing those in pre-defined Data Group Lists. For simplicity, the URIs in the Data Group Lists must only contain the URIs that web clients are allowed to access. Websocket URIs must be explicitly defined in the irule itself. In order to separate the URIs on a per application basis, the configuration described below defines a Data Group List for each application together with a list for the URIs associated with some sample applications: Fusion Web Gateway e.g. FusionGatewayUris Fusion Live Assist server URIs e.g. FusionLiveAssistServerUris URIs of all the sample applications e.g. FusionSampleAppUris When configuring the URI Data Group Lists, they must be entered as String-Value pairs. The sections below show the URIs within each of the groups defined above. Note: The URIs may be different to those used in the enterprise s environment, and therefore may need updating appropriately. Note: For v10, the URIs relating to the Websocket connections MUST NOT be in these lists. Note: The Javascript URIs are only relevant for browser clients. 8.1 Application URIs Fusion Web Gateway URIs String /gateway/adapter.js /gateway/csdk-aed.js /gateway/csdk-common.js Value /gateway/adapter.js /gateway/csdk-aed.js /gateway/csdk-common.js F5 Configuration HTTPS/WSS Offloading 23

25 /gateway/csdk-phone.js /gateway/csdk-sdk.js /gateway/uc.js /gateway/promise.js /gateway/phone /gateway/aed /gateway/browserplugin /gateway/ie /gateway/safariplugin /gateway/websocketcall /gateway/csdk-phone.js /gateway/csdk-sdk.js /gateway/uc.js /gateway/promise.js /gateway/phone /gateway/aed /gateway/browserplugin /gateway/ie /gateway/safariplugin /gateway/websocketcall F5 Configuration HTTPS/WSS Offloading 24

26 8.1.2 Fusion Live Assist Server URIs The following are required for public customer access: String /assistserver/bundleserver /assistserver/consumer /assistserver/defaultuiresources /assistserver/img /assistserver/sdk/web /assistserver/topic /assistserver/session Value /assistserver/bundleserver /assistserver/consumer /assistserver/defaultuiresources /assistserver/img /assistserver/sdk/web /assistserver/topic /assistserver/session The following are required for public agent access: String /assistserver/agent /assistserver/bundleserver /assistserver/defaultuiresources /assistserver/img /assistserver/sdk/web /assistserver/topic /assistserver/session Value /assistserver/agent /assistserver/bundleserver /assistserver/defaultuiresources /assistserver/img /assistserver/sdk/web /assistserver/topic /assistserver/session F5 Configuration HTTPS/WSS Offloading 25

27 8.1.3 Fusion Sample Application URIs String /csdk-sample/ /agent/console/ /assist-agent-console/ /assistsample/ /assist-resourcemanager Value /csdk-sample/ /agent/console/ *NOT SHOWN /assist-agent-console/ /assistsample/ /assist-resourcemanager F5 Configuration HTTPS/WSS Offloading 26

28 8.2 Websocket URIs Both FCSDK and Live Assist utilise Websockets for call control and screen-share functionality and their URIs have been listed below: Application FCSDK Live Assist Websocket URI /gateway/websocketcall /assistserver/topic F5 Configuration HTTPS/WSS Offloading 27

29 8.3 The irule The code below shows the irule used to restrict access to URIs using the Data Group Lists defined above, while also showing how to allow Websockets access. Note: The URIs relating to the Websocket connections for FCSDK and Live Assist MUST be explicitly defined in the irule for older versions. At versions later or at 11.6, at least, websockets calls do not need a special rule. For older versions, the irule is the following when CLIENT_ACCEPTED { } when HTTP_REQUEST { if { ([ starts_with "/gateway/websocketcall") } { } elseif { ([ starts_with "/assistserver/topic") } { } elseif { ([ equals "/csdk-sample") # These are all sample/demo applications ([ equals "/assistsample") ([ equals "/agent/console") ([ equals "/assist-agent-console") } { # Change it to end with '/' "[ } elseif { ([class match [ starts_with FusionGatewayUris]) ([class match [ starts_with FusionLiveAssistServerUris]) ([class match [ starts_with FusionSampleAppUris]) } { # Leave HTTP profile enabled and pass traffic through } else { drop F5 Configuration HTTPS/WSS Offloading 28

30 } } This irule will drop any requests to any URI outside of the defined Data Group Lists. This irule should be associated with the virtual server as shown earlier. The SSL offloading process will decrypt requests from clients and apply this irule, allowing or rejecting access to the back end servers. NOTE: An open F5 issue: SOL12938, states that calling the ' function from within an irule may result in a TMM core. However, this issue occurs when ALL of the following conditions are met: 1. The Cache Setting feature is enabled within the HTTP profile. 2. OneConnect is enabled within the HTTP profile. 3. An irule is configured and calls the function. Note that the configuration described within this document does NOT meet the required conditions for this issue to be relevant in this deployment. Although ' has been invoked in the irule, the default HTTP profile that has been used when defining the HTTPS Virtual Server has its OneConnect property enabled, but the RAM Cache disabled. F5 has been tested with the OneConnect property both enabled and disabled, without any change in application behaviour. For v11 of F5 BIG-IP, the irule simplifies to when CLIENT_ACCEPTED { } when HTTP_REQUEST { if { ([ equals "/csdk-sample") # These are all sample/demo applications ([ equals "/assistsample") ([ equals "/agent/console") ([ equals "/assist-agent-console") } { # Change it to end with '/' "[ } elseif { ([class match [ starts_with FusionGatewayUris]) ([class match [ starts_with FusionLiveAssistServerUris]) ([class match [ starts_with FusionSampleAppUris]) } { F5 Configuration HTTPS/WSS Offloading 29

31 # Leave HTTP profile enabled and pass traffic through } else { drop } } The irule for v12+ of F5 BIG-IP is simplified further to: when HTTP_REQUEST { if { ([ equals "/csdk-sample") # These are all sample/demo applications ([ equals "/assistsample") ([ equals "/agent/console") ([ equals "/assist-agent-console") } { # Change it to end with '/' "[ } elseif { ([class match [ starts_with FusionGatewayUris]) ([class match [ starts_with FusionLiveAssistServerUris]) ([class match [ starts_with FusionSampleAppUris]) } { # Leave HTTP profile enabled and pass traffic through } else { drop } } F5 Configuration HTTPS/WSS Offloading 30

32 9 Contact information For technical support or other queries, contact CaféX Communications Support at: For our worldwide corporate office addresses, please visit: F5 Configuration HTTPS/WSS Offloading 31