F5 SSL Orchestrator Topologies

F5 SSL Orchestrator configuration topologies define the type of traffic (transparent or explicit) and the direction of traffic flow (inbound or outbound) you wish to inspect. These deployment settings, which can be modified as needed without undeploying a configuration, are complimented by SSL management settings that assist you in defining inbound decryption and outbound decryption, setting your service types (such as HTTP, ICAP, Layer 2/Layer 3 inline, and receive-only/TAP services) and creating your service policies by defining per-request and per-session policy settings that can be managed through a virtual policy editor.

• Outbound transparent proxy
• Outbound explicit proxy
• Inbound reverse proxy
• Outbound layer 2
• Inbound layer 2

Licensing and Provisioning for SSL Orchestrator Access Integration

Updated SSL Orchestrator Setup Utility with resource provisioning capabilities for licensed and unlicensed modules.

Access Per-Request Policies Visual Policy Editor (VPE)

The SSL Orchestrator VPE provides a dedicated screen on which to configure a per-request policy using visual elements. Policies you create during the configuration of your deployment are available within the VPE. Each element, or box, represents a corresponding macro whose information (and output) influences the next element and its macro, until the traffic is either allowed or blocked.

Multi-Layered Security

In order to solve specific security challenges, security administrators are accustomed to manually chaining together multiple point products, creating a bare-bones “security chain” consisting of multiple services. A typical chain may include components like Data Leak Prevention (DLP) scanners, Web Application Firewalls (WAF), Intrusion Prevention and Detection Systems (IPS and IDS), Malware Analysis tools, Secure Web Gateways (SWG), and more. In this model, all user sessions are provided the same level of security, as this “daisy chain” of services is hard-wired.

Virtual Clustered Multiprocessing (vCMP)

SSL Orchestrator supports Virtual Clustered Multiprocessing (vCMP) to provision and manage multiple hosted instances of the BIG-IP software on a single hardware platform.

Classification Engine

Classification Engine provides a rich set of methods based on context to dynamically determine how best to optimize the flow through the security stack. Context can minimally come from the following:

• Source IP/subnet
• Destination IP/subnet
• IP intelligence category - Subscription
• IP geolocation
• Host and domain name
• URL filtering category - Subscription
• Destination port
• Protocol

Other classifiers with greater flexibility are also available in the SSL Orchestrator VPE and with iRules to optimize and evaluate additional information.

Deployment Modes

In addition, the system can detect and transparently handle an explicit proxy between F5 SSL Orchestrator and the internet.

SSL Orchestrator Analytics

SSL Orchestrator analytics provide a customizable view into your SSL Orchestrator statistics, and enable you to flexibly choose the information you want to view based on specified ranges of time that you can select and adjust.

Statistics generated:

• Hit Count
• Client Bytes Out Per Second
• Duration
• Server Bytes In
• Server Bytes In Per Second
• Hit Count Per Second
• Server Bytes Out Per Second
• Client Bytes In
• Client Bytes In Per Second
• Client Bytes Out
• Server Bytes Out

Statistics are generated for the following dimensions:

• Client Cipher Names
• Client Cipher Versions
• Server Cipher Names
• Server Cipher Versions
• Virtual Servers
• Site IP Addresses
• Traffic Types
• Decryption Status
• Policy Actions
• Service Paths
• URL Categories
• Applications
• Application Families
• IP Reputation
• Destination Countries

L7 Application Protocol Settings

SSL Orchestrator supports L7 application protocol settings allowing you to select a protocol to listen for specific traffic (IMAP, SMTPS, POP3, FTP, HTTP) to be processed.

How to Contact F5 Support or the Anti-Fraud SOC

You can manage service requests and other web-based support online at F5 My Support (registration required). To register email CSP@F5.com with your F5 hardware serial numbers and contact information.

You can contact the Anti-Fraud SOC as follows:

• By phone in the U.S. (accessible 24x7): 866-329-4253 (Option #3 for Anti-Fraud)
• International contact numbers: https://f5.com/products/platforms/silverline/f5-silverline-ddos-protection

Additional resources

You can find additional support resources and technical documentation through a variety of sources.

F5 Networks Technical Support

Free self-service tools give you 24x7 access to a wealth of knowledge and technical support. Whether it is providing quick answers to questions, training your staff, or handling entire implementations from design to deployment, F5 services teams are ready to ensure that you get the most from your F5 technology.

AskF5 Knowledge Base

AskF5 is your storehouse for thousands of knowledgebase articles that help you manage your F5 products more effectively. Whether you want to browse periodically to research a solution, or you need the most recent news about your F5 products, AskF5 is your source.

F5 DevCentral

The F5 DevCentral community helps you get more from F5 products and technologies. You can connect with user groups, learn about the latest F5 tools, and discuss F5 products and technology.

F5 Publication Subscription Center AskF5 Publication Preference Center

To subscribe, click F5 Publication Subscription Center, enter your email address, select the publications you want, and click the Submit button. You will receive a confirmation email. You can unsubscribe at any time by clicking the Unsubscribe link at the bottom of the email, or on the F5 Publication Subscription Center screen.