F5 GOV Round Table - Securing Application Access

Editor's Notes

• #3: BIG-IP APM = AAA control on BIG-IP Integrates with AAA servers—including Active Directory, LDAP, RADIUS, and Native RSA SecurID
• #4: Add-On Module for BIG-IP Family (For new BIG-IP platforms, e.g. 3600, 3900, 6900, 6900 FIPS, 8900, 8950 and 11050. Available as an add-on module for BIG-IP LTM.)Access Profile for Local Traffic Virtual Servers (Very simple configuration to add an Access Policy to an LTM Virtual. Just select an Access Profile from the pulldown menu under the LTM Virtual configuration page. The rest of the Access Policy is configured under the Access Control left-hand menu, where AAA servers are configured, ACLs and ACEs are defined, and VPE is used to create the visual policy.)APM Policy Engine (This is the advanced policy engine behind APM add-on for BIG-IP)Industry Leading Visual Policy Editor (VPE) (See screenshot. Next generation of visual policy editor which has been a big selling point for FirePass. Others, e.g. Cisco, and started trying to copy, but years behind in this area).VPE Rules (TCL-based) for Advanced Policies (Ability to edit the iRules-like TCL rules behind the VPE directly, for advanced configurations, or to create all new rules for custom deployments. Tight integration between the VPE rules and TMM iRules – e.g. ability to drive Access Policies via TMM iRules, Access Policy creating new iRules events, etc.).Endpoint SecurityMore than a dozen different endpoint security checks available (Large number of agents available, e.g. Virtual Keyboard, AV and firewall checks, process, file, and registry checks, extended Windows info, client and machine certificates, etc.)Manage endpoints via Group Policy enforcement and Protected Workspace (Endpoint remediation capabilities like Protected Workspace and Full Armor-based AD Policy enforcement, in addition to Cache Cleaner, redirects to remediation pages, and message and decision boxes).Authentication and AuthorizationFlexible authentication and authorization capabilities via client cert, AD, LDAP, RADIUS, RSA SecurID agents (Broad array of authentication, authorization, and accounting capabilities – including RADIUS accounting).Access ControlHigh-Performance Dynamic Layer 4 and Layer 7 (HTTP/HTTPS) ACLs (Role/User-based Access Control engine built directly into TMM, via hudfilters. Supports dynamic assignment and enforcement of layer 4 ACL/firewall capabilities, as well as now supporting dynamic layer-7 HTTP/HTTPS URL-based access controls. High-performance as built directly into dataplane.)
• #5: Endpoint SecurityMore than a dozen different endpoint security checks available (Large number of agents available, e.g. Virtual Keyboard, AV and firewall checks, process, file, and registry checks, extended Windows info, client and machine certificates, etc.)Manage endpoints via Group Policy enforcement and Protected Workspace (Endpoint remediation capabilities like Protected Workspace and Full Armor-based AD Policy enforcement, in addition to Cache Cleaner, redirects to remediation pages, and message and decision boxes).
• #13: Web Access Management – BIG-IP proxies the customer’s web applications and provides authentication, authorization, endpoint inspection, and more – all typing into Layer 4-7 ACLS through F5’s easy-to-use Visual Policy Editor.
• #16: Exchange / Active Sync – The application Access solution helps secure Exchange deployment across Active Sync / Mobile, Outlook Web Access and Outlook Anywhere. In addition to access control and security, F5 can aid in disaster recover, Exchange 2007 to 2010 migration and provide single namespace capabilities. Secures Active Sync / Mobile, OWA and Outlook AnywhereAssists in disaster recovery and Exchange 2007 to 2010 migrationMigrate over time Authenticate usersSingle URL accessManaged accessAfter migrationScale to 60K usersNo cross-CAS overhead High availabilityExpanded bullets:Solution allows organizations to migrate over-time while BIG-IP APM authenticated users in the DMZ to ensure there are no unknown users accessing the system.Organizations can distribute a single URL and depending on user or group – BIG-IP APM will direct the user to the appropriate server for Exchange iteration (OWA / ActiveSync or Outlook Anywhere)This give users direct access to email without updating bookmarks or settingsOranizations can alsom manage email access for all devices from all locations and any network.
• #18: Single sign-on (SSO) – users login to BIG-IP once and enjoy seamless access to all web resources, leveraging a variety of SSO methods (SAML, Credential Caching, Kerberos) to integrate with common applications. This allows system administrators to provision and de-provision application to applications uniformly, even when apps live in the cloudF5 HelpsDramatically reduce infrastructure costs; increase productivityProvides seamless access to all web resourcesIntegrated with common applications
• #23: Single sign-on (SSO) – users login to BIG-IP once and enjoy seamless access to all web resources, leveraging a variety of SSO methods (SAML, Credential Caching, Kerberos) to integrate with common applications. This allows system administrators to provision and de-provision application to applications uniformly, even when apps live in the cloudF5 HelpsDramatically reduce infrastructure costs; increase productivityProvides seamless access to all web resourcesIntegrated with common applications
• #35: Supports users worldwide Secure IPsec site to site tunnelsFast apps to Edge Client usersVirtual and standalone deploymentsAPM v11 on Edge Gateway surpasses VPN feature parity IPSec (iSessions) site to site (gateway to gateway) extending layer 3 networks vs. initial IPSec (client to site) where normally SSL VPN is a replacementApp Tunnels: new and improved Easily configurable Dynamic WebtopFlash patching