Features and Terminology in F5 Guided Configuration for SSL Orchestrator

SSL Orchestrator now supports a Snapshots utility that lets you create a backup copy of your deployed configurations. You can preserve your existing configurations as an iFILE and provide yourself with a restore point. The Snapshot feature lets you freely experiment with configuration settings and restore your backed-up configurations quickly when required.

SSL Orchestrator 10.1 now offers Office 365 Tenant Restrictions within the SSL Orchestrator interface, specifically in the F5 tab as part of the Solutions Catalog. This update enables organizations to control their users' access only to the company Office 365 resources while blocking access to personal/non-company Office 365 resources. In addition, the SSL Orchestrator injects Microsoft "Tenant-Restriction" HTTP headers into outbound HTTP flows and provides a mechanism to allow or deny access to O365 resources based on organizational requirements.

SSL Orchestrator now allows you to create a schedule to fetch O365 URLs and add fetched data to custom URL categories/data groups according to their specifications. You can attach the URL category to an SSLO security policy to dictate which traffic will be inspected or bypassed and then deploy the policy to managed BIG-IP devices.

SSL Orchestrator Security Policy step now has the following enhancements while creating a new rule:

This implementation requires a Certificate Authority PKI (public key infrastructure) certificate and matching private key for SSL Forward Proxy. Your TLS clients must trust this CA certificate to sign server certificates.

An inspection zone refers to the network region between separate ingress and egress BIG-IP® devices where cleartext data is available for inspection. Basically, an extra inline service can be placed at the end of every service chain for additional inspection. You cannot configure a decrypt zone in the scenario where a single BIG-IP system handles both ingress and egress traffic because the inspection zone does not exist.

F5 Guided Configuration for SSL Orchestrator is meant to guide you through setting up a particular use case on the SSL Orchestrator system. Each template requests minimal input and provides contextual help to assist users during setup.

The current version displays on the landing page. To upgrade SSL Orchestrator, you can download the SSL Orchestrator RPM(.rpm) file from F5 Downloads (Security) to your local workstation and then choose the downloaded RPM file for uploading and installing.

Refer to the Update or Upgrade the F5 SSL Orchestrator chapter in the

BIG-IP update and upgrade

guide for detailed steps on installing and upgrading to the newest version.

You can configure inline HTTP explicit proxy (EP) or transparent proxy (TP) settings with SSL Orchestrator configured as either an explicit or transparent proxy for extended SSL visibility and existing or new deployments. Using SSL Orchestrator, the inline proxy device can be in either transparent or explicit mode, irrespective of SSL Orchestrator's mode.

Each ICAP service uses the ICAP protocol (https://tools.ietf.org/html/rfc3507) to refer HTTP traffic to one or more Content Adaptation device(s) for inspection and possible modification. You can add an ICAP service to any TCP service chain, but only HTTP traffic is sent to it, as we do not support ICAP for other protocols. You can configure up to ten ICAP services using F5® SSL Orchestrator™.

Inline services pass traffic through one or more service (inspection) devices at Layer2 (MAC)/Bump-in-the-wire or Layer3 (IP). Each service device communicates with the SSL Orchestrator device over two VLANs called

Inward

and

Outward

which carry traffic toward the intranet and the Internet respectively. You can configure up to ten inline services, each with multiple defined devices, using SSL Orchestrator.

Receive-only services refer to services that only receive traffic for inspection, and do not send it back to the BIG-IP system. Each receive-only service provides a packet-by-packet copy of the traffic (e.g. plaintext) passing through it to an inspection device. You can configure up to ten receive-only services using SSL Orchestrator.

The F5 Office 365 Tenant Restrictions service provide a mechanism to allow or deny access to O365 resources based on organizational requirements. You will require your organization's

Restrict-Access-To-Tenants

and

Restrict-Access-Context

values to be inserted into HTTP headers. You can obtain the Tenant Domain and Tenant ID values from the Microsoft Azure portal by signing in as the Administrator. Click Office 365 Tenant Restrictions for detailed information on Tenant Restrictions.

The SSL Orchestrator uses a visual per-request policy engine, or Visual Policy Editor (VPE), to define traffic flows through the security services. Security policies are available within the VPE with each element, or box, representing a corresponding macro whose information (and output) influences the next element and its macro, until the traffic is either allowed or blocked.

SSL Orchestrator service chains process specific connections based on rules which look at protocol, source and destination addresses, and so on. These service chains can include five types of services (HTTP services, Layer 2 inline services, Layer 3 inline services, receive-only/TAP services, and ICAP services) you define, as well as any decrypt zone between separate ingress and egress devices.

A SNAT (Secure Network Address Translation) is a feature that defines routable alias IP addresses that the BIG-IP system substitutes for client IP source addresses when making connections to hosts on the external network. A SNAT pool is a pool of translation addresses that you can map to one or more original IP addresses. Translation addresses in a SNAT pool should not be self IP addresses.

By selecting the strict update option (on the Guided Configuration Welcome screen in a column labelled

Protected/Unprotected Configurations

) for deployed configurations, you cannot manually modify any settings produced by the application. Once you disable this option (click on the lock symbol), you can manually change your configuration. F5 recommends you keep this setting enabled (locked) to avoid misconfigurations that can result in an unusable application and limit F5's ability to support your product. The strict update check box is enabled/selected by default.

A Sync-Failover device group (part of the Device Service Clustering (DSC®) functionality) contains BIG-IP devices that synchronize their configuration data and failover to one another when a device becomes unavailable. In this configuration, a Sync-Failover device group supports a maximum of two devices.

You can operate in transparent and/or explicit proxy mode. A transparent proxy intercepts normal communication without requiring any special client configuration; clients are unaware of the proxy in the network. In this implementation, the transparent proxy scheme can intercept all types of TLS and TCP traffic. It can also process UDP and forward other types of IP traffic. The explicit proxy scheme supports only HTTP(S) per RFC2616. In addition, transparent proxy supports direct routing for policy-based routing (PBR) and Web Cache Communication Protocol (WCCP) that are dependent on networking services to support both protocols, while explicit proxy supports manual browser settings for proxy auto-config (PAC) and Web Proxy Autodiscovery Protocol (WPAD) that require additional iRule configurations (not included) to provide the PAC/WPAD script content.