2018 Hands-on Guide. F5 Azure SACA. F5 Networks, Inc.

Transcription

1 2018 Hands-on Guide F5 Azure SACA F5 Networks, Inc.

2 2

3 Contents: 1 F5 Azure SACA - Index Welcome

4 4

5 1 F5 Azure SACA - Index 1.1 Welcome Welcome to the F5 Azure SACA guide. The content contained here provides a Notional SCCA Deployment based on: stigs/pdf/scca_frd_v2-9.pdf Source code can be found in the GitHub repository at This is F5 Contributed Software About F5 Azure SACA The following is a guide of some of the terms that will be used in this document as well as a reference to resources for additional information. SACA Secure Azure Computing Architecture for DoD (SACA) is a notional deployment of SCCA. SCCA SCCA is an abrievation for Secure Cloud Computing Architecture that is outlined in the following document: This architecture provides guidance on requirements for securing Cloud Computing Environments based on US DoD experience. It outlines recommended components including a Cloud Access Point (CAP), Virtual Datacenter Security Stack (VDSS), Virtual Datacenter Managed Service (VDMS), and Trusted Cloud Credential Manager (TCCM). Azure Microsoft Azure is a leading provider of Cloud Computing resources and provides both a US Government and US DoD Cloud Computing Environments. 5

6 F5 F5 Networks provides products and solutions for high availability, security, and performance optimization of Cloud Computing environments. F5 Azure SCCA This document will focus on the deployment of virtual resources in support of an SCCA environment. SCCA can be a combination of physical and virtual resources. The deployed example architecture can be utilized to aid fulfilling requirements around segmentation of traffic, visibility of encrypted traffic, and security of application protocols that are outlined in the SCCA document Deploying F5 Azure SACA ARM Template To complete this guide requires that you have an Azure US Government account. The guide will go through the steps of launching an Azure ARM template to create a VNet that represents a VDSS and VDMS network. It will also create jumpbox resources (Windows/Linux) that will be used for Management access and F5 devices that will be used to secure ingress and egress traffic. Connect to Azure Portal First login to the Azure Portal at: (US Government) OR (Commercial) Note: This requires a Azure Government Subscription OR Azure Subscription Enable Programmatic Access to F5 Resources Before you launch the template; you will need to enable programmatic deployment for your F5 devices. Go to Marketplace From the top search field in the Azure Portal search for marketplace Find F5 BIG-IP In the Market place search enter f5 byol best and hit the enter key. 6

7 Click on F5 BIG-IP ADC BEST - BYOL Warning: DO NOT SELECT F5 BIG-IP ADC+SEC BEST BYOL Verify that you have the correct version by looking at the description and you should see..version: At the very bottom of the page click on Want to deploy programmatically? Enable Programmatic Deployment Click on Enable next to the Subscription 7

8 Create a Service Principal A Service Principal will be used to deploy F5 BIG-IP devices and be used by the BIG-IP s to dynamically update Azure User Defined Routes (UDR). The following steps are how to create a Service Principal via the Azure Portal. You will need to retrieve the following three pieces of information that will be used later. 1. Application ID (a.k.a. Client ID) 2. Application Key (a.k.a. Client Secret) 3. Tenant ID It is recommended to create a text file (i.e. using Notepad) that contains: tenant id: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX client id: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX secret: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX The following will guide you on how to retrieve this information via the Azure Portal OR Azure CLI (choose one method) Create Service Principal via Azure CLI Use this method if you prefer using a command line interface or have access to Cloud Shell (available in Azure Cloud, not available in Microsoft Azure Government). To access Azure Cloud Shell see: First verify the subscription. student01@azure:~$ az account show { "environmentname": "AzureCloud", "id": "XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXXXX", "isdefault": true, "name": "my_subscription", "state": "Enabled", "tenantid": "YYYYY-YYYY-YYYY-YYYY-YYYYYYYYYY", "user": { "name": "studnt01@example.com", "type": "user" }} If you do not see the correct subscription run to view subscriptions student01@azure:~$ az account list Then set the default to the correct subscription. student01@azure:~$ az account set -s XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXXXX To create your service principal run (replace student01 with a unique value or bigip ) student01@azure:~$ az ad sp create-for-rbac -n "student01-sp" Retrying role assignment creation: 1/36 { "appid": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX", "displayname": "student01-sp", 8

9 } "name": " "password": "SSSSSSSS-SSSS-SSSS-SSSS-SSSSSSSSSSSS", "tenant": "TTTTTTTT-TTTT-TTTT-TTTT-TTTTTTTTTTTT" Tip: When using Azure Cloud Shell you will need to highlight the text in your browser and right-click and select copy to copy and paste the text from the browser. Save the values of tenant, password, and appid to your text file that you created earlier. Create Service Principal via Azure Portal If you used the Azure CLI to create your Service Principal you can skip the following. Note: The following is adapted from: resource-group-create-service-principal-portal#create-an-azure-active-directory-application Click on Azure Active Directory In the menu on the left click on Azure Active Directory. Create App Registration Next click on App Registrations And click on New application registration. Enter a name (i.e. bigipsp ) and a Sign-on URL (i.e. ). Note: If you are using a shared subscription; please use a unique identifier i.e. student01-bigipsp Retrieve App ID Next you will need to retrieve the Application ID and authentication key. Under App Registrations find the App that you created in the previous step. Copy the Application ID. You will need this value later. This is the first piece of information that you will need. Tip: A Click to Copy button will appear when you hover on the right side of the ID 9

10 10

11 11

12 Generate Key To the right of the Application ID click on the Keys link. Provide a description (i.e. bigip key ) and duration. After saving the key be sure to save the value. This is the secret key and will not be retrievable again. This is the second piece of information that you will need. Grant Role The Service Principal will need to have Contributor access to create BIG-IP devices and manage UDR routes. The following steps will guide you in granting this role to your Azure Subscription. You can later opt to limit access to specific Resource Groups. Under Cost Management + Billing find your Azure Subscription. Click on Access control (IAM) Under Role select Contributor. Under Select type the name of the principal that you previously created (i.e. bigipsp ). Select that principal. Click Save Get Directory ID The third piece of information that you will need is the Tenant ID. Under Azure Active Directory retrieve the Directory ID. 12

13 13

14 Note: Please see: resource-group-create-service-principal-portal#get-tenant-id Launch Deployment Custom Deployment Click on the following link: Azure Government com%2ff5devcentral%2ff5-azure-saca%2fmaster%2froles%2ff5-azure-scca%2ffiles% 2Fazuredeploy.json Azure Cloud com%2ff5devcentral%2ff5-azure-saca%2fmaster%2froles%2ff5-azure-scca%2ffiles% 2Fazuredeploy.json You should see. Username and Password Fill in the required username/password for the VDSS Jump Boxes. These devices will be used for administrative access to the environment. F5 Information Next fill in the three pieces of information that was previously collected for the Service Principal and F5 license keys. 14

15 Terms and Conditions Accept the Terms and Conditions and click Purchase. Verify Template Complete It will take ~40 - ~60 minutes for the template to complete. Under Resource Groups find the Deployments item and verify that you see Succeeded F5 Azure SCCA - Architecture Overview The following is a diagram of the traffic flow of the template that was deployed. 15

16 Traffic originates from the Client through a Cloud Access Point. This would be an Express Route connection, but in the previous template the Public Internet can be used for demonstration purposes. As traffic enters the environment it is first inspected by an External pair of F5 devices. These External devices are responsible for providing edge filtering protection of traffic at L3/L4, address translation of egress traffic, and terminating SSL connections for later inspection by the IPS device and F5 Internal devices (WAF). For demonstration purposes a generic Linux server has been deployed to emulate an IPS device. High Availability The resources are deployed in an Active/Standby pair to provide High Availability. 16

17 Depending on the protocol and security requirements this can be also done in an Active/Active manner. In this example template, an Azure Load Balancer is utilized to reduce failover time, but this can be deployed without an Azure Load Balancer. This example also has a single point of failure with a single IPS device. In a production environment it would be expected to deploy an IPS solution in an HA configuration similar to the F5 Internal devices. Traffic Visibility The F5 External/Internal devices are both configured to collect Network Firewall event logs. For demonstration purposes these are being stored locally, but they can also send logs to external ArcSight, Splunk, IPFIX, Remote Syslog, or Azure OMS logging destinations. The F5 Internal device is also configured with a Web Application Firewall (WAF) and is capable of logging HTTP traffic. In this example template the Internal devices are configured to capture HTTP request logs locally. Similar to the Network Firewall, the WAF can be configured for external logging destinations. This architecture also provides the original Client IP to the destination Application through the use of Azure User Defined Routes (UDR). Using UDR, all egress Application traffic is also sent through the F5 devices. The F5 External devices can also be utilized to terminate SSL connections to provide SSL Visibility to the IPS and F5 Internal devices. The F5 Internal devices can re-encrypt SSL connections before the traffic is sent to Management or Mission Owner networks. Security The F5 External/Internal devices are tiered to provide mutiple levels of protections. 17

18 The F5 External devices and IPS device are capable of deflecting L3/L4 based attacks; while the F5 Internal device can address L7 based attacks. Integration Behind the scenes this sample environment is employing Azure services. Availability Sets ensure that the F5 Device pairs are scheduled for maintenance at appropriate times. The Azure SDK is utilized to failover Azure Route Table entries that provides the visiblity of Client IP address and ensures that all egress traffic traverses the F5 devices. The template itself is using Azure Resource Management templates to automate the process of deploying Azure resources. Azure Load Balancer is used to improve failover times and Azure OMS can be used for external logging where available SCCA Details Topology After the template completes deploying there will be the following devices deployed. 18

19 External F5 Devices (x2) IPS Device (Linux host) Internal F5 Devices (x2) Linux Jumpbox Windows Jumpbox SCCA VDSS As part of VDSS Security Requirements the Jumpbox is separated into its own subnet (SCCA Req. ID ) access is also limited to SSH/RDP (w/ TLS) (Req. ID ). The F5 BIG-IP acts as a reverse proxy (Req. ID ). Use of the F5 BIG-IP AFM (network firewall) and ASM (web application firewall) modules can be used in relation to limit/inspect/enforce application traffic (SCCA Req. ID , , , , , ). Event data capture on F5 BIG-IP can be sent to external log sources ( ). By performing SSL termination of application traffic BIG-IP can support requirements around break and inspect of SSL/TLS traffic (Req. ID ) and also support sending traffic inline or out-of-band to additional IPS/IDS devices in support of SCCA VDSS requirements. Verifying a complete deployment The template will create VDSS VNet VDSS Route Tables VDSS Management Hosts (Windows/Linux) IPS Host (Linux) Azure Load Balancers F5 External Resource Group F5 Internal Resource Group Verify that you see the expected resource groups (should appear within ~10 minutes of launch). You should see [original resource group] [original resource group]_f5_external [original resource group]_f5_internal 19

20 Resources Clicking on the [original resource group] name you should see a set of resources including. Virtual Network Azure Load Balancers Public IP Addresses Virtual Machines Public IP Addresses You should see 3 Public IP Addresses. The linux-vdssjumpbox-ip can be used to access the Linux jumpbox via SSH while the automation deployment is launching. Once the deployment completes you will no longer be able to access the environment via this IP Address. Record the Public IP Addresses for f5-ext-pip0 and f5-ext-pip1. Click on the resource and copy down the IP address. Note: Your IP Address will differ than the example screenshot. Troubleshooting the Deployment If you do not see the _F5_ resource groups you can log onto the linux jumpbox to check on the status of the deployment or look for errors. SSH to the linux-vdssjumpbox-ip host. 20

21 % tail -f /var/log/cloud-init-output.log PLAY [localhost] ******************************************************************************************** ***************************************************************************************************** TASK [Gathering Facts] ************************************************************************************** ***************************************************************************************************** ok: [localhost] TASK [f5-azure-scca : Check if resource group exists] ******************************************************* ***************************************************************************************************** ok: [localhost] TASK [f5-azure-scca : Deploy SCCA Environnment] ************************************************************* ***************************************************************************************************** skipping: [localhost]... Demo Sites Using a web browser try to access the IP Address of f5-ext-pip1 via HTTPS. i.e. Tip: You may need to click past certificate errors Also verify you can connect to address]. Access Windows Jumpbox The Windows Jumpbox can be used to access resources in the environment. The following will guide you through connecting to the jumpbox and configuring it to access internal resources. Using a Windows RDP client create an RDP connection to the Public IP Address f5-ext-pip0. 21

22 When prompted select the option to Use a different account. Specify the username/password entered for the VDMSS jumpbox username/password in the ARM template. Once you connect you should see the Server Manager Dashboard. Click on Local Server in the menu. Click on IE Enhanced Security Configuration -> On. Change the settings to Off (This is not recommended for production, but used for demonstration purposes). Open up Internet Explorer and accept default settings. Login to F5 BIG-IP Devices The F5 BIG-IP Devices are configured to only allow connections from the jumpbox devices. From the Windows jumpbox: Browse to Click past certificate warnings (recommended to install CA signed certificates for production use). 22

23 You should see the login for the F5 BIG-IP. Login using the same credentials to access the RDP host. Repeat for: Extend Idle Timeout (Optional) By default the session will timeout after 20 minutes. To change the timeout to 1 day. Go to System -> Preferences. Change the value to Active Device The F5 BIG-IP devices are deployed in an Active/Standby configuration. They can also be deployed in an Active/Active mode, but Active/Standby is used for this environment to ease the process of identifying the device that is processing traffic. To determine the Active device take note of the top left of the page. Firewall Logs The F5 BIG-IP AFM modules provides network firewall capabilities and DDoS protection. Find the Active device of the External F5 Devices. It will be either:

24 From the menu on the left of the screen access Security -> Event Logs -> Network -> Firewall An example of filtering the log output is to click on Custom Search then click and drag Port from the column to the top of the page. Enter the port 3389 and click search Note that you should see your connecting IP address as well as the destination address of the RDP connection. Normally you be unable to log the original destination IP address, but we are using the Azure Load Balancer to make this information visible. We ll take a look at the Azure Load Balancer in the next section. On the same BIG-IP device browse to Local Traffic -> Virtual Servers. You ll see that the external IP Address is configured on the BIG-IP. Azure Load Balancer - External Go back to the Azure Portal and click on the Resource Group and find the Azure Load Balancers (this is the same Resource Group where you found the Public IP Address). Click on f5-ext-alb and click on Load balancing rules 24

25 Then click on rdp_vs Note that Floating IP (direct server return) is set to Enabled WAF logs In addition to providing network firewall capabilities, F5 BIG-IP ASM module provides a web application firewall that can deter L7 attacks. Unlike a traditional firewall; a WAF is capable of providing a mixture of positive/negative security policies as well as intercept and modify response data as needed (DLP / BOT mitigation). Find the Active device of the Internal F5 Devices. It will be either:

26 From the menu on the left of the screen access Security -> Event Logs -> Application -> Requests Initially you will see no data. Click on the X next to Illegal Requests to show all results. You can browse through the requests to see more data. Simulated L7 Attack (optional) The following will simulate an attack that will trigger a WAF policy. First make a request to Change the method to propfind and submit. This will trigger a block for an illegal method. This type of attack can be used when an attacker is trying to find insecure webdav file shares. 26

27