DOCSLIB.ORG

Pulse Secure Virtual Traffic Manager: User's Guide

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Pulse Secure Virtual Traffic Manager: User's Guide Pulse Secure Virtual Traffic Manager: User’s Guide Supporting Pulse Secure Virtual Traffic Manager 18.3 Product Release 18.3 Published 26 November, 2018 Document Version 1.0 Pulse Secure Virtual Traffic Manager: User’s Guide Pulse Secure, LLC 2700 Zanker Road, Suite 200 San Jose CA 95134 www.pulsesecure.net © 2018 by Pulse Secure, LLC. All rights reserved. Pulse Secure and the Pulse Secure logo are trademarks of Pulse Secure, LLC in the United States. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Pulse Secure, LLC assumes no responsibility for any inaccuracies in this document. Pulse Secure, LLC reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Pulse Secure Virtual Traffic Manager: User’s Guide The information in this document is current as of the date on the title page. END USER LICENSE AGREEMENT The Pulse Secure product that is the subject of this technical documentation consists of (or is intended for use with) Pulse Secure software. Use of such software is subject to the terms and conditions of the End User License Agreement (“EULA”) posted at http://www.pulsesecure.net/support/eula/. By downloading, installing or using such software, you agree to the terms and conditions of that EULA. © 2018 Pulse Secure, LLC. Pulse Secure Virtual Traffic Manager: User’s Guide Contents PREFACE . 1 DOCUMENT CONVENTIONS . 1 TEXT FORMATTING CONVENTIONS . 1 COMMAND SYNTAX CONVENTIONS . 1 NOTES AND WARNINGS. 2 REQUESTING TECHNICAL SUPPORT . 2 SELF-HELP ONLINE TOOLS AND RESOURCES. 2 OPENING A CASE WITH PSGSC . 3 TRAFFIC MANAGER OVERVIEW . 5 ABOUT THIS GUIDE. 5 INTENDED AUDIENCE . 5 INTRODUCING THE TRAFFIC MANAGER . 5 TYPICAL DEPLOYMENT . 7 TRAFFIC MANAGER PRODUCT VARIANTS. 7 THE TRAFFIC MANAGER COMMUNITY EDITION . 8 SUPPORTED PLATFORMS. 8 SUPPORTED CLUSTER COMBINATIONS. 9 CHAPTER OUTLINE. 10 NETWORK LAYOUTS . 13 ESSENTIALS OF NETWORK CONFIGURATION . 13 DEDICATED MANAGEMENT NETWORK. 14 SIZING YOUR CLUSTER . 15 BACK-END SERVERS . 15 CONTENT MANAGEMENT ON BACK ENDS. 15 FRONT-END SERVERS. 15 IP TRANSPARENCY . 17 ROUTING CONFIGURATION. 18 LOCAL ROUTING PROBLEMS . 19 IP TRANSPARENCY AND TRAFFIC MANAGER CLUSTERS . 19 TRAFFIC IP ADDRESSES AND TRAFFIC IP GROUPS . 19 TRAFFIC IP ADDRESS MODES. 20 EXAMPLE CONFIGURATIONS . 21 USING IP TRANSPARENCY WITH A CLUSTER . 24 ROUTE HEALTH INJECTION AND THE NETWORK. 26 INTRODUCTION TO IPV6. 30 © 2018 Pulse Secure, LLC. i Pulse Secure Virtual Traffic Manager: User’s Guide MAIN FEATURES OF IPV6 IN THE TRAFFIC MANAGER . 30 TECHNICAL RESTRICTIONS. 30 INITIAL CONFIGURATION . .33 ARCHITECTURE CONCEPTS . 33 MANAGING YOUR FIRST SERVICE . 35 USING THE WIZARD TO CREATE A VIRTUAL SERVER AND POOL. 35 CREATING A POOL AND VIRTUAL SERVER MANUALLY . 36 CREATING A CLUSTER . .37 JOINING A CLUSTER . 37 JOINING CLUSTERS WITH TRAFFIC IP GROUPS . 40 VIRTUAL SERVERS. 41 INTRODUCTION . 41 USING VIRTUAL SERVERS . 41 SELECTING A PROTOCOL. 42 APPLYING RULES . 43 SSL DECRYPTION. 44 DECRYPTING SSL PASS-THROUGH TRAFFIC . 45 SERVICE PROTECTION CLASSES. 45 BANDWIDTH MANAGEMENT CLASSES . 45 SERVICE LEVEL MONITORING CLASSES . 46 HTTP CONTENT CACHING. 46 WEB ACCELERATOR . 46 HTTP CONTENT COMPRESSION. ..
Load more

Recommended publications
  • Elastic Load Balancing Application Load Balancers Elastic Load Balancing Application Load Balancers
    Elastic Load Balancing Application Load Balancers Elastic Load Balancing Application Load Balancers Elastic Load Balancing: Application Load Balancers Copyright © Amazon Web Services, Inc. and/or its affiliates. All rights reserved. Amazon's trademarks and trade dress may not be used in connection with any product or service that is not Amazon's, in any manner that is likely to cause confusion among customers, or in any manner that disparages or discredits Amazon. All other trademarks not owned by Amazon are the property of their respective owners, who may or may not be affiliated with, connected to, or sponsored by Amazon. Elastic Load Balancing Application Load Balancers Table of Contents What is an Application Load Balancer? .................................................................................................. 1 Application Load Balancer components ......................................................................................... 1 Application Load Balancer overview ............................................................................................. 2 Benefits of migrating from a Classic Load Balancer ........................................................................ 2 Related services ......................................................................................................................... 3 Pricing ...................................................................................................................................... 3 Getting started .................................................................................................................................
    [Show full text]
  • TR-069 CPE WAN Management Protocol V1.1
    TECHNICAL REPORT TR-069 CPE WAN Management Protocol v1.1 Version: Issue 1 Amendment 2 Version Date: December 2007 © 2007 The Broadband Forum. All rights reserved. CPE WAN Management Protocol v1.1 TR-069 Issue 1 Amendment 2 Notice The Broadband Forum is a non-profit corporation organized to create guidelines for broadband network system development and deployment. This Technical Report has been approved by members of the Forum. This document is not binding on the Broadband Forum, any of its members, or any developer or service provider. This document is subject to change, but only with approval of members of the Forum. This document is provided "as is," with all faults. Any person holding a copyright in this document, or any portion thereof, disclaims to the fullest extent permitted by law any representation or warranty, express or implied, including, but not limited to, (a) any warranty of merchantability, fitness for a particular purpose, non-infringement, or title; (b) any warranty that the contents of the document are suitable for any purpose, even if that purpose is known to the copyright holder; (c) any warranty that the implementation of the contents of the documentation will not infringe any third party patents, copyrights, trademarks or other rights. This publication may incorporate intellectual property. The Broadband Forum encourages but does not require declaration of such intellectual property. For a list of declarations made by Broadband Forum member companies, please see www.broadband-forum.org. December 2007 © The Broadband
    [Show full text]
  • Alibaba Cloud
    AAlliibbaabbaa CClloouudd Alibaba Cloud SSerrvveer rL oLaoda Bda laBnaclearncer ListLeinsetresners Document Version: 20210922 Document Version: 20210922 Server Load Balancer List eners·Legal disclaimer Legal disclaimer Alibaba Cloud reminds you t o carefully read and fully underst and t he t erms and condit ions of t his legal disclaimer before you read or use t his document . If you have read or used t his document , it shall be deemed as your t ot al accept ance of t his legal disclaimer. 1. You shall download and obt ain t his document from t he Alibaba Cloud websit e or ot her Alibaba Cloud- aut horized channels, and use t his document for your own legal business act ivit ies only. The cont ent of t his document is considered confident ial informat ion of Alibaba Cloud. You shall st rict ly abide by t he confident ialit y obligat ions. No part of t his document shall be disclosed or provided t o any t hird part y for use wit hout t he prior writ t en consent of Alibaba Cloud. 2. No part of t his document shall be excerpt ed, t ranslat ed, reproduced, t ransmit t ed, or disseminat ed by any organizat ion, company or individual in any form or by any means wit hout t he prior writ t en consent of Alibaba Cloud. 3. The cont ent of t his document may be changed because of product version upgrade, adjust ment , or ot her reasons. Alibaba Cloud reserves t he right t o modify t he cont ent of t his document wit hout not ice and an updat ed version of t his document will be released t hrough Alibaba Cloud-aut horized channels from t ime t o t ime.
    [Show full text]
  • Memento: Time Travel for the Web
    Memento: Time Travel for the Web Herbert Van de Sompel Michael L. Nelson Robert Sanderson Los Alamos National Old Dominion University, Los Alamos National Laboratory, NM, USA Norfolk, VA, USA Laboratory, NM, USA [email protected] [email protected] [email protected] Lyudmila L. Balakireva Scott Ainsworth Harihar Shankar Los Alamos National Old Dominion University, Los Alamos National Laboratory, NM, USA Norfolk, VA, USA Laboratory, NM, USA [email protected] [email protected] [email protected] ABSTRACT 1. INTRODUCTION The Web is ephemeral. Many resources have representa- \The web does not work," my eleven year old son com- tions that change over time, and many of those represen- plained. After checking power and network connection, I tations are lost forever. A lucky few manage to reappear realized he meant something rather more subtle. The URI as archived resources that carry their own URIs. For ex- (http://stupidfunhouse.com) he had bookmarked the year ample, some content management systems maintain version before returned a page that didn't look like the original at pages that reflect a frozen prior state of their changing re- all, and definitely was not fun. He had just discovered that sources. Archives recurrently crawl the web to obtain the the web has a terrible memory. actual representation of resources, and subsequently make Let us restate the obvious: the Web is the most pervasive those available via special-purpose archived resources. In information environment in the history of humanity; hun- both cases, the archival copies have URIs that are protocol- dreds of millions of people1 access billions of resources2 using wise disconnected from the URI of the resource of which a variety of wired or wireless devices.
    [Show full text]
  • TR-069: CPE WAN Management Protocol
    TECHNICAL REPORT TR-069 CPE WAN Management Protocol Issue: Amendment 6 Corrigendum 1 Issue Date: June 2020 CWMP Version: 1.4 © Broadband Forum. All rights reserved. CPE WAN Management Protocol TR-069 Issue Amendment 6 Corrigendum 1 Notice The Broadband Forum is a non-profit corporation organized to create guidelines for broadband network system development and deployment. This Technical Report has been approved by members of the Forum. This Technical Report is subject to change. This Technical Report is owned and copyrighted by the Broadband Forum, and all rights are reserved. Portions of this Technical Report may be owned and/or copyrighted by Broadband Forum members. Intellectual Property Recipients of this Technical Report are requested to submit, with their comments, notification of any relevant patent claims or other intellectual property rights of which they may be aware that might be infringed by any implementation of this Technical Report, or use of any software code normatively referenced in this Technical Report, and to provide supporting documentation. Terms of Use 1. License Broadband Forum hereby grants you the right, without charge, on a perpetual, non- exclusive and worldwide basis, to utilize the Technical Report for the purpose of developing, making, having made, using, marketing, importing, offering to sell or license, and selling or licensing, and to otherwise distribute, products complying with the Technical Report, in all cases subject to the conditions set forth in this notice and any relevant patent and other intellectual property rights of third parties (which may include members of Broadband Forum). This license grant does not include the right to sublicense, modify or create derivative works based upon the Technical Report except to the extent this Technical Report includes text implementable in computer code, in which case your right under this License to create and modify derivative works is limited to modifying and creating derivative works of such code.
    [Show full text]
  • Flow-Based Compromise Detection Rick Hofstede Graduation Committee
    Flow-based Compromise Detection Rick Hofstede Graduation Committee Chairman: Prof. dr. P.M.G. Apers Promotor: Prof. dr. ir. A. Pras Co-promotor: Prof. Dr. rer. nat. G. Dreo Rodosek Members: dr. A. Sperotto University of Twente, The Netherlands Prof. dr. P.H. Hartel University of Twente, The Netherlands Delft University of Technology, The Netherlands TNO Cyber Security Lab, The Netherlands Prof. dr. ir. L.J.M. Nieuwenhuis University of Twente, The Netherlands Prof. dr. ir. C.T.A.M. de Laat University of Amsterdam, The Netherlands Prof. dr. ir. H.J. Bos VU University, The Netherlands Prof. Dr. rer. nat. U. Lechner Universit¨atder Bundeswehr M¨unchen, Germany Prof. Dr. rer. nat. W. Hommel Universit¨atder Bundeswehr M¨unchen, Germany Funding sources EU FP7 UniverSelf { #257513 EU FP7 FLAMINGO Network of Excellence { #318488 EU FP7 SALUS { #313296 EIT ICT Labs { #13132 (Smart Networks at the Edge) SURFnet GigaPort3 project for Next-Generation Networks CTIT Ph.D. thesis series no. 16-384 Centre for Telematics and Information Technology CTIT P.O. Box 217 7500 AE Enschede, The Netherlands ISBN: 978-90-365-4066-7 ISSN: 1381-3617 DOI: 10.3990/1.9789036540667 http://dx.doi.org/10.3990/1.9789036540667 Typeset with LATEX. Printed by Gildeprint, The Netherlands. Cover design by David Young. This thesis is licensed under a Creative Commons Attribution- NonCommercial-ShareAlike 3.0 Unported License. http://creativecommons.org/licenses/by-nc-sa/3.0/ This thesis has been printed on paper certified by FSC (Forest Stewarding Council). FLOW-BASED COMPROMISE DETECTION THESIS to obtain the degree of doctor at the University of Twente, on the authority of the Rector Magnificus, prof.
    [Show full text]
  • Kernel HTTPS/TCP/IP Stack for HTTP Ddos Mitigation
    Kernel HTTPS/TCP/IP stack for HTTP DDoS mitigation Alexander Krizhanovsky Tempesta Technologies, Inc. [email protected] Who am I? CEO & CTO at Tempesta Technologies (Seattle, WA) Developing Tempesta FW – open source Linux Application Delivery Controller (ADC) Custom software development in: ● high performance network traffic processing e.g. WAF mentioned in Gartner magic quadrant ● Databases e.g. MariaDB SQL System Versioning https://github.com/tempesta-tech/mariadb https://m17.mariadb.com/session/technical-preview-temporal- querying-asof HTTPS challenges HTTP(S) is a core protocol for the Internet (IoT, SaaS, Social networks etc.) HTTP(S) DDoS is tricky ● Asymmetric DDoS (compression, TLS handshake etc.) ● A lot of IP addresses with low traffic ● Machine learning is used for clustering ● How to filter out all HTTP requests with “Host: www.example.com:80”? ● "Lessons From Defending The Indefensible": https://www.youtube.com/watch?v=pCVTEx1ouyk TCP stream filter IPtables strings, BPF, XDP, NIC filters ● HTTP headers can cross packet bounds ● Scan large URI or Cookie for Host value? Web accelerator ● aren’t designed (suitable) for HTTP filtering IPS vs HTTP DDoS e.g. Suricata, has powerful rules syntax at L3-L7 Not a TCP end point => evasions are possible SSL/TLS SSL terminator is required => many data copies & context switches or double SSL processing (at IDS & at Web server) Double HTTP parsing Doesn’t improve Web server peroformance (mitigation != prevention) Interbreed an HTTP accelerator and a firewall TCP & TLS end point Very fast
    [Show full text]
  • Stopping DNS Rebinding Attacks in the Browser
    Stopping DNS Rebinding Attacks in the Browser Mohammadreza Hazhirpasand, Arash Ale Ebrahim and Oscar Nierstrasz University of Bern, Switzerland Keywords: DNS Rebinding, Browser Security, Web Security. Abstract: DNS rebinding attacks circumvent the same-origin policy of browsers and severely jeopardize user privacy. Although recent studies have shown that DNS rebinding attacks pose severe security threats to users, up to now little effort has been spent to assess the effectiveness of known solutions to prevent such attacks. We have carried out such a study to assess the protective measures proposed in prior studies. We found that none of the recommended techniques can entirely halt this attack due to various factors, e.g., network layer encryption renders packet inspection infeasible. Examining the previous problematic factors, we realize that a protective measure must be implemented at the browser-level. Therefore, we propose a defensive measure, a browser plug-in called Fail-rebind, that can detect, inform, and protect users in the event of an attack. Afterwards, we discuss the merits and limitations of our method compared to prior methods. Our findings suggest that Fail- rebind does not necessitate expert knowledge, works on different OSes and smart devices, and is independent of networks and location. 1 INTRODUCTION bypass firewalls, gain access to either internal ma- chines in the victim’s private network or the victim’s In a DNS rebinding attack, an attacker uses a custom resources, fetch sensitive resources, and compromise DNS server to spoof the IP address of the victim, and vulnerable internal machines. thus obtain read access to the victim’s server.
    [Show full text]
  • Webdav) Protocol: Microsoft Extensions
    [MS-WDVME]: Web Distributed Authoring and Versioning (WebDAV) Protocol: Microsoft Extensions Intellectual Property Rights Notice for Open Specifications Documentation . Technical Documentation. Microsoft publishes Open Specifications documentation (“this documentation”) for protocols, file formats, data portability, computer languages, and standards support. Additionally, overview documents cover inter-protocol relationships and interactions. Copyrights. This documentation is covered by Microsoft copyrights. Regardless of any other terms that are contained in the terms of use for the Microsoft website that hosts this documentation, you can make copies of it in order to develop implementations of the technologies that are described in this documentation and can distribute portions of it in your implementations that use these technologies or in your documentation as necessary to properly document the implementation. You can also distribute in your implementation, with or without modification, any schemas, IDLs, or code samples that are included in the documentation. This permission also applies to any documents that are referenced in the Open Specifications documentation. No Trade Secrets. Microsoft does not claim any trade secret rights in this documentation. Patents. Microsoft has patents that might cover your implementations of the technologies described in the Open Specifications documentation. Neither this notice nor Microsoft's delivery of this documentation grants any licenses under those patents or any other Microsoft patents. However, a given Open Specifications document might be covered by the Microsoft Open Specifications Promise or the Microsoft Community Promise. If you would prefer a written license, or if the technologies described in this documentation are not covered by the Open Specifications Promise or Community Promise, as applicable, patent licenses are available by contacting [email protected].
    [Show full text]
  • A Comprehensive Formal Security Analysis of Oauth 2.0
    A Comprehensive Formal Security Analysis of OAuth 2.0∗ Daniel Fett Ralf Küsters University of Trier, Germany University of Trier, Germany [email protected] [email protected] Guido Schmitz University of Trier, Germany [email protected] The OAuth 2.0 protocol is one of the most widely deployed authorization/single sign-on (SSO) proto- cols and also serves as the foundation for the new SSO standard OpenID Connect. Despite the popularity of OAuth, so far analysis efforts were mostly targeted at finding bugs in specific implementations and were based on formal models which abstract from many web features or did not provide a formal treat- ment at all. In this paper, we carry out the first extensive formal analysis of the OAuth 2.0 standard in an ex- pressive web model. Our analysis aims at establishing strong authorization, authentication, and session integrity guarantees, for which we provide formal definitions. In our formal analysis, all four OAuth grant types (authorization code grant, implicit grant, resource owner password credentials grant, and the client credentials grant) are covered. They may even run simultaneously in the same and different relying parties and identity providers, where malicious relying parties, identity providers, and browsers are considered as well. Our modeling and analysis of the OAuth 2.0 standard assumes that security recommendations and best practices are followed in order to avoid obvious and known attacks. When proving the security of OAuth in our model, we discovered four attacks which break the security of OAuth. The vulnerabilities can be exploited in practice and are present also in OpenID Connect.
    [Show full text]
  • Understanding Internet Censorship Policy: the Case of Greece
    Understanding Internet Censorship Policy: The Case of Greece Vasilis Ververis George Kargiotakis Arturo Filasto` Humboldt University Berlin The Tor Project Benjamin Fabian Afentoulis Alexandros Humboldt University Berlin Abstract the offending blog post via automatic RSS syndication. In February 2010 ISP Tellas/Wind Hellas blocked the The Greek government has recently initiated large scale Piratebay site [1]. In May 2012 the Greek Organiza- content blocking that leads to Internet censorship. In tion for Intellectual Property Collective Administration this article we analyze the techniques and policies used (AEPI) went to court against every Greek ISP demand- to block content of gambling websites in Greece and ing to censor Ellinadiko.com, a music sharing forum and present the implications of the detected underblock- Music-Bazaar.com, an MP3 webstore, both under the ac- ing and overblocking. We have collected results prob- cusation of infringing copyright laws [2]. The court or- ing eight major broadband and cellular Internet Service dered the ISPs to block the IP addresses of the referred Providers (ISPs) that are a representative sample of In- websites [23]. ternet usage in Greece, and investigate the methods and Later in September 2012 a citizen was arrested on infrastructure used to conduct the contentfiltering. The charges of malicious blasphemy and religious insult af- results of this study highlight issues related to how trans- ter posting a Facebook page that ridiculed a well-known parently Internetfiltering is implemented in democratic Greek Orthodox monk [12]. Following in January 2013, countries and could indicate the presence of unfair com- a politicianfiled a defamation lawsuit against a Greek petition between ISPs.
    [Show full text]
  • Oracle CRM on Demand REST API Developer's Guide
    CRM On Demand Oracle CRM On Demand REST API Developer’s Guide Release 32 June 2016 Copyright © 2005, 2016 Oracle. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error- free. If you find any errors, please report them to us in writing. If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are “commercial computer software” pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government. This software or hardware is developed for general use in a variety of information management applications.
    [Show full text]