Jak uzyska widoczno w zaszyfrowanym ruchu SSL Orchestrator

Jak uzyskać widoczność w zaszyfrowanym ruchu? SSL Orchestrator MACIEJ IWANICKI Senior Systems Engineer 11

SSL Adoption Source: https: //www. ssllabs. com/ssl-pulse/ 2 | © 2018 F 5 NETWORKS

SSL - Privacy is NOT Security 3 | © 2018 F 5 NETWORKS

SSL - Privacy is NOT Security 4 | © 2018 F 5 NETWORKS

SSL Visibility Traditional SSL Daisy-Chain Network Design inspect Web Gateway DLP/ICAP IDS/TAP IPS/NGFW decrypt

SSL Orchestrator Introduction 6 | © 2018 F 5 NETWORKS

SSL Orchestrator Cipher Diversity The proxy architecture allows for independent control of client-side and

SSL Orchestrator Dynamic Device Support 8 | © 2018 F 5 NETWORKS Web Gateway

SSL Orchestrator Dynamic Service Chaining Context-based classification policies allow different types of traffic to

SSL Orchestrator Dynamic Scaling A full proxy architecture provides for robust load balancing, monitoring

SSL Orchestrator Dynamic Evaluation The ability to dynamically introduce and evaluate new services and

SSL Orchestrator Technology Advantages Cipher Diversity The proxy architecture allows for independent control of

SSL Orchestrator Configuration Walk Through 15 | © 2018 F 5 NETWORKS

SSL Orchestrator 16 | © 2018 F 5 NETWORKS

SSL Orchestrator Guided Configuration: Topologies 17 | © 2018 F 5 NETWORKS

SSL Orchestrator Guided Configuration: SSL Settings 18 | © 2018 F 5 NETWORKS

SSL Orchestrator Guided Configuration: Services 19 | © 2018 F 5 NETWORKS

SSL Orchestrator Guided Configuration: Services 20 | © 2018 F 5 NETWORKS

SSL Orchestrator Guided Configuration: Services 21 | © 2018 F 5 NETWORKS

SSL Orchestrator Guided Configuration: Services 22 | © 2018 F 5 NETWORKS

SSL Orchestrator Guided Configuration: Service Chain 23 | © 2018 F 5 NETWORKS

SSL Orchestrator Guided Configuration: Security Policy 24 | © 2018 F 5 NETWORKS

SSL Orchestrator Guided Configuration: Interception Rule 25 | © 2018 F 5 NETWORKS

SSL Orchestrator Guided Configuration: Egress 26 | © 2018 F 5 NETWORKS

SSL Orchestrator Guided Configuration: Summary 27 | © 2018 F 5 NETWORKS

SSL Orchestrator Guided Configuration: Dashboard 28 | © 2018 F 5 NETWORKS

SSL Orchestrator Guided Configuration: Dashboard 29 | © 2018 F 5 NETWORKS

SSL Orchestrator Resources Product Page : https: //www. f 5. com/products/security/ssl-orchestrator Demo Video :

Slides: 31

Download presentation

SSL Visibility Traditional SSL Daisy-Chain Network Design inspect Web Gateway DLP/ICAP IDS/TAP IPS/NGFW decrypt encrypt % decrypt encrypt Challenges & Realities of Daisy-Chaining • • • 5 | © 2018 F 5 NETWORKS Multiple Intercept Points Multiple Points of Failure Increased Latency Increased Complexity Complicated troubleshooting Performance Impacts • • • Impacts “Perfect” Forward Secrecy Reduced Security ROI Must go through every service Over-subscribing services Complicated Mesh HA Designs Bypass on failure (added Hardware)

SSL Orchestrator Cipher Diversity The proxy architecture allows for independent control of client-side and server-side ciphers and protocols, and is impervious to mismatch conditions. A Functional Overview server-side [Intercept/Bypass] SSL Encrpytion SSL Decryption Classification client-side SSL Orchestrator • • 7 | © 2018 F 5 NETWORKS IP Reputation • Destination SSL Decryption occurs Port based on Source IP • Domain Name/SNI classification Service Chain Destination IP • URL Filtering assigned. Action is either to Categoryor Bypass. Intercept (decrypt) IP Geolocation • Protocol SSLO Flow Support Ingress (inbound) & Egress (outbound) flow support.

SSL Orchestrator Dynamic Device Support 8 | © 2018 F 5 NETWORKS Web Gateway IDS/TAP DLP/ICAP IPS/NGFW [Intercept/Bypass] SSL Decryption Classification A Functional Overview SSL Orchestrator supports: • Inline HTTP (Web Proxy) • Inline Layer 3 • Inline Layer 2 • DLP/ICAP • TAP Security Devices.

SSL Orchestrator Dynamic Service Chaining Context-based classification policies allow different types of traffic to flow through different chains of reusable security services IDS/TAP DLP/ICAP IPS/NGFW SSL Encrpytion Web Gateway [Intercept/Bypass] SSL Decryption Classification A Functional Overview Dynamic Service Chain Classification 9 | © 2018 F 5 NETWORKS HTTP Decryption [Intercept] Web Gateway DLP/ICAP Other Decryption [Intercept] IDS/TAP IPS/NGFW Finance Decryption [BYPASS] IPS/NGFW IDS/TAP IPS/NGFW Re-Encryption

SSL Orchestrator Dynamic Service Chaining Context-based classification policies allow different types of traffic to flow through different chains of reusable security services IDS/TAP DLP/ICAP IPS/NGFW SSL Encrpytion Web Gateway [Intercept/Bypass] SSL Decryption Classification A Functional Overview Dynamic Service Chain Classification 10 | © 2018 F 5 NETWORKS HTTP Decryption [Intercept] Web Gateway DLP/ICAP Other Decryption [Intercept] IDS/TAP IPS/NGFW Finance Decryption [BYPASS] IPS/NGFW IDS/TAP IPS/NGFW Re-Encryption

SSL Orchestrator Dynamic Service Chaining Context-based classification policies allow different types of traffic to flow through different chains of reusable security services IDS/TAP DLP/ICAP IPS/NGFW SSL Encrpytion Web Gateway [Intercept/Bypass] SSL Decryption Classification A Functional Overview Dynamic Service Chain Classification 11 | © 2018 F 5 NETWORKS HTTP Decryption [Intercept] Web Gateway DLP/ICAP Other Decryption [Intercept] IDS/TAP IPS/NGFW Finance Decryption [BYPASS] IPS/NGFW IDS/TAP IPS/NGFW Re-Encryption

SSL Orchestrator Dynamic Scaling A full proxy architecture provides for robust load balancing, monitoring and independent scaling of any number of security devices. IDS/TAP DLP/ICAP IPS/NGFW SSL Encrpytion Web Gateway [Intercept/Bypass] SSL Decryption Classification A Functional Overview % Dynamic Service Chain Classification 12 | © 2018 F 5 NETWORKS HTTP Decryption [Intercept] Web Gateway DLP/ICAP Other Decryption [Intercept] IDS/TAP IPS/NGFW Finance Decryption [BYPASS] IPS/NGFW IDS/TAP IPS/NGFW Re-Encryption

SSL Orchestrator Dynamic Evaluation The ability to dynamically introduce and evaluate new services and service chains with test traffic before altering production designs. Dynamic Service Chains Classification 13 | © 2018 F 5 NETWORKS IDS/TAP DLP/ICAP IPS/NGFW SSL Encrpytion Web Gateway [Intercept/Bypass] SSL Decryption Classification A Functional Overview HTTP Decryption [Intercept] Web Gateway Other Decryption [Intercept] IDS/TAP Finance Decryption [BYPASS] IPS/NGFW Test Traffic Decryption [Intercept] Web Gateway IDS/TAP IPS/NGFW Re-Encryption IPS/NGFW DLP/ICAP Re-Encryption IDS/TAP IPS/NGFW Re-Encryption

SSL Orchestrator Technology Advantages Cipher Diversity The proxy architecture allows for independent control of client side and server side ciphers and protocols, and is impervious to mismatch conditions. 14 | © 2018 F 5 NETWORKS Dynamic Device Support SSL Orchestrator supports: • Inline HTTP • Inline Layer 3 • Inline Layer 2 • DLP/ICAP • TAP security devices. Dynamic Service Chaining Context-based policies allow different types of traffic to flow through different chains of reusable security services. Dynamic Scaling A full proxy architecture provides for robust load balancing, monitoring and independent scaling of any number of security devices. Dynamic Evaluation The ability to dynamically introduce and evaluate new services and service chains with test traffic before altering production designs.