Guided Configuration for SSL Orchestrator

Guided configuration is meant to guide you through setting up a particular use case on the SSL Orchestrator system. Each template requests minimal input and provides contextual help to assist users during setup. The current version of the Guided Configuration is displayed on the landing page. When a later upgrade becomes available, you can use the available link next to the version number to download it from downloads.f5.com then upload and install Guided Configuration for SSL Orchestrator on BIG-IP. Prior to installing and upgrading to the latest version of SSL Orchestrator, ensure that you read the release notes and setup guide for any prerequisites, task details, or troubleshooting and recovery steps during installation or upgrade.

SSL Orchestrator High Availability (HA) behavior improvements

A streamlined SSL Orchestrator upgrade procedure allows upgrade capabilities that do not break the HA pair.

Strict Update option (Protected/Unprotected Configurations) improvements

The SSL Orchestrator Protected/Unprotected Configurations improvements provide: the ability to view the configuration differences between created and out of band (OOB) modified changes; the ability to preview configuration changes before applying the changes to the system; the option to either overwrite configuration changes or accept the changes before deployment.

Modify network objects through iAppLX

This feature allows you to change network objects thru iApplx. Network objects created for SSL Orchestrator Services like IPs and VLANs can now be modified once created without needing to delete/recreate the service in order to change the network objects.

HA-Status monitoring and remediation dashboard

SSL Orchestrator upgrades, deployments, and synchronization can be painful if the HA pair is in a bad state. This feature provides status of your HA pair before the upgrade and a remediation button to help fix any issues to ensure you proceed with the HA upgrade when in a good state. This feature also prevents unwanted configuration changes or modifications to an existing SSL Orchestrator configuration, minimizing discrepancies between the two HA devices and their configuration.

SSL Orchestrator HA diagnostics and sync-repair tool

SSL Orchestrator users with a HA setup may use the ha-sync tool and script to troubleshoot and fix HA setup issues (such as when gossip has gone out of sync, when some REST blocks are missing/out of sync, or even when MCP data is out of sync between devices).

The ha-sync script includes the diagnostic capability to identify potential issues and can print out all of the issues found with the HA setup. The ha-sync script can then perform a sync-up, which should fix those issues, and ensure that both devices are fully in sync (both in MCP and REST). See the F5 Guided Configuration for SSL Orchestrator: High Availability Diagnostics and Sync-Repair Tool guide for detailed information.

Guided Configuration for SSL Orchestrator TLS 1.3 support

TLS 1.3 support is provided in Guided Configuration for SSL Orchestrator for inbound cases, both clientssl and serverssl, for enhanced performance and security.

SSL Orchestrator Topologies

SSL Orchestrator configuration topologies define the type of traffic (transparent or explicit) and the direction of traffic flow (inbound or outbound) you wish to inspect. These deployment settings, which can be modified as needed without undeploying a configuration, are complimented by SSL management settings that assist you in defining inbound decryption and outbound decryption, setting your service types (such as HTTP, ICAP, Layer 2/Layer 3 inline, and receive-only/TAP services) and creating your service policies by defining per-request and per-session policy settings that can be managed through a virtual policy editor.

• Outbound transparent proxy
• Outbound explicit proxy
• Inbound reverse proxy
• Outbound layer 2
• Inbound layer 2

The Existing Application topology is an inbound topology that allows you to create services, service chains, and security policies and attach them to an existing reverse proxy BIG-IP application.

Licensing and Provisioning for SSL Orchestrator Access Integration

Updated SSL Orchestrator Setup Utility with resource provisioning capabilities for licensed and unlicensed modules.

Multi-Layered Security

In order to solve specific security challenges, security administrators are accustomed to manually chaining together multiple point products, creating a bare-bones “security chain” consisting of multiple services. A typical chain may include components like Data Leak Prevention (DLP) scanners, Web Application Firewalls (WAF), Intrusion Prevention and Detection Systems (IPS and IDS), Malware Analysis tools, Secure Web Gateways (SWG), and more. In this model, all user sessions are provided the same level of security, as this “daisy chain” of services is hard-wired.

Virtual Clustered Multiprocessing (vCMP)

SSL Orchestrator supports Virtual Clustered Multiprocessing (vCMP) to provision and manage multiple hosted instances of the BIG-IP software on a single hardware platform.

Classification Engine

Classification Engine provides a rich set of methods based on context to dynamically determine how best to optimize the flow through the security stack. Context can minimally come from the following:

• Source IP/subnet
• Destination IP/subnet
• IP intelligence category - Subscription
• IP geolocation
• Host and domain name
• URL filtering category - Subscription
• Destination port
• Protocol

Other classifiers with greater flexibility are also available in the SSL Orchestrator VPE and with iRules to optimize and evaluate additional information.

Deployment Modes

In addition, the system can detect and transparently handle an explicit proxy between SSL Orchestrator and the internet.

SSL Orchestrator Analytics

SSL Orchestrator analytics provide a customizable view into your SSL Orchestrator statistics, and enable you to flexibly choose the information you want to view based on specified ranges of time that you can select and adjust.

Statistics generated:

• Hit Count
• Client Bytes Out Per Second
• Duration
• Server Bytes In
• Server Bytes In Per Second
• Hit Count Per Second
• Server Bytes Out Per Second
• Client Bytes In
• Client Bytes In Per Second
• Client Bytes Out
• Server Bytes Out

Statistics are generated for the following dimensions:

• Client Cipher Names
• Client Cipher Versions
• Server Cipher Names
• Server Cipher Versions
• Virtual Servers
• Site IP Addresses
• Traffic Types
• Decryption Status
• Policy Actions
• Service Paths
• URL Categories
• Applications
• Application Families
• IP Reputation
• Destination Countries

L7 Application Protocol Settings

SSL Orchestrator supports L7 application protocol settings allowing you to select a protocol to listen for specific traffic (IMAP, SMTPS, POP3, FTP, HTTP) to be processed.