Fortinet ADN (Application Delivery Network)

Editor's Notes

• #22: What is a web application firewall? At its most basic, a WAF is a hardware or virtual device that is deployed in a data center that is used to protect web-based applications from attacks that exploit code-based or layer 7 vulnerabilities. At the core of every WAF is a behavior-based engine that learns, monitors and reacts. Once deployed, the WAF automatically learns application traffic patterns, field entries, URLs and other core application elements to build “normal” behavior profiles. It then monitors application traffic and usage against these profiles. It then reacts when an activity steps outside the profile boundaries, usually this means blocking traffic from the offending user. As WAFs are behavior-based, they’re not locked in to pre-defined signatures and they’re adaptive to zero-day threats. WAFs can use signatures, and most do to automatically stop attacks on known exploits to cut down on processing overhead. Many also use IP reputation services to block IP addresses that are known to be threats. A WAF can do many other things too, such as scanning an application for vulnerabilities, load balance applications, publish applications, and provide secure traffic offloading. However, it’s main job is to protect applications from malicious behaviors at the code-level for either custom or off-the-shelf applications. Many of you may be wondering if a firewall with intrusion prevention can do this just as well. An IPS is a great service to protect against known attacks, however it relies on signatures and can’t detect encrypted attacks. If complete protection against zero-day and SSL-encrypted attacks is needed, a WAF is the only solution available today.
• #23: Even with solid application design and regular maintenance, a web-based application is still inherently a weak point for data breaches. Older applications present even more of a challenge as they require more and more work to plug security holes in the code or may not have security patches available for its software platform. The very likely threat of a data breach should be reason enough to install a WAF, however most organizations that are actively pursuing WAF solutions are those that must meet the Payment Card Industry Data Security Standards, also known as PCI DSS. Any organization that stores and transmits credit card information must be PCI compliant in order to use any of the major credit card networks such as VISA, MasterCard and American Express. In order to be completely PCI compliant, an organization must protect their applications from the OWASP Top 10 as part of the PCI DSS 6.0 requirements. I won’t get too much into OWASP, but it’s a non-profit organization that is dedicated to web application security that Fortinet is a member of. Their top 10 list for 2013 is the latest and includes things like cross-site scripting, the ability for an attacker to embed malicious code returned to a user, and SQL Injection, the ability to hijack form fields to execute SQL commands directly to databases. PCI DSS 5.5 is a simple provision that states that systems must be protected by antivirus software. WAFs also can do other things as we mentioned earlier. Outside of application protection, they’re an easy way to publish web-based applications and are the best line of defense to protect against website defacement. So, who needs a WAF? Generally any organization that manages credit card payments due to PCI compliance and organizations that need to ensure their applications are secure to protect sensitive data and proprietary information. In red, the verticals or segments that need it most generally are MSPs and hosting companies, any company that deals in e-commerce or operates online services, retail, food service, hospitality, financial services and healthcare.
• #24: Fortinet offers a complete line of web application firewalls under the FortiWeb brand. First introduced in 2009, FortiWeb has matured into a recognized value and performance leader in WAFs as recognized in the 2014 NSS WAF Security Value Map achieving a “recommended” rating. FortiWeb offers 4 models with throughputs ranging from 100 Mbps up to 4 Gbps. Depending on the model, it also includes the latest in high-speed connectivity with up to 2 10-gigabit SFP+ ports. Unlike other competitors, FortiWeb is the only WAF that includes a built-in vulnerability scanner and antivirus for complete PCI DSS 5.5 and 6.6 compliance out of the box. Like all WAFs in the market, FortiWeb provides automatic behavior-based scanning with auto-setup and learning modes. In addition, FortiWeb also offers additional features like layer 7 DDoS protection, IP Reputation, central management with administrative domains, SSL offloading, Single-sign-on and authentication for application publishing, and layer 7 load balancing. FortiWeb is also very flexible when it comes to deployment options with transparent, reverse and non-inline deployment modes. FortiWeb is available as a hardware or virtual appliance and supports Amazon Web Services, with the option to bring-your-own license or it can be purchased “on-demand” through the AWS marketplace. Please note that we strive to maintain the accuracy and timeliness of these training deck pages. However, please be sure to check Fortinet.com for the latest models and features.
• #25: As I mentioned earlier, FortiWeb is available as a virtual appliance. We offer 4 VM versions with support for up to 8 CPUs. The FortiWeb VMs provide the same features and functionality of the hardware-based models, however they provide the flexibility and scale to deploy them as needed without extra hardware and device management. FortiWeb VMs provide enterprise-grade WAF capabilities that dynamically expand to meet an organization’s needs for maximum resource efficiency. We offer full support of many platforms including VMware, Microsoft Hyper-V, Citrix XenServer, Open Source Xen and full support for Amazon Web Services with options for bring your own licenses, or it can be purchased on-demand through the AWS marketplace.
• #27: The next few slides focus on the key features of FortiWeb. First up is its core WAF protection and automatic setup. Every WAF offers automatic protection to detect and mitigate web-based application attacks. FortiWeb is no different. Once deployed in a datacenter, FortiWeb begins to monitor all traffic and usage patterns for applications it’s assigned to. In most cases, even without any changes to the default configuration, within minutes it has enough information to begin protecting applications from threats. It learns what fields an application has, what data is “normal”, what isn’t. It learns URLs and other data sources that normal users encounter and remembers it. If an attacker starts to redirect users to strange URLs, the traffic is blocked. If a user tries to execute a SQL command through a form field. It’s blocked. All this is done transparently to the user and doesn’t require any changes or modifications to the application code itself. Although FortiWeb uses “pre-checks” like attack signatures and IP Reputation, this behavioral scanning takes it a step further to detect and block attacks where there’s no signature or from a new IP source that hasn’t yet been identified. Only a WAF can do this for applications as it learns, understands and knows what should be going on and what shouldn’t. If it’s not “normal”, it gets identified, flagged and in most cases, “blocked”.
• #28: A WAF’s core job is to protect your applications by patching security holes from attackers. Vulnerability scanning finds the holes so they can be patched in advance. FortiWeb’s built-in vulnerability scanning can be run regularly or as needed to look at all application elements to ensure they aren’t susceptible to attacks like cross site scripting, SQL Injection or source disclosures. Once complete, it provides a detailed report of all issues so they can be addressed. Even though FortiWeb continues to protect against these problems, it’s better to fix the known issues so FortiWeb can get on with protecting against new threats that crop up. For customers that need to meet PCI compliance, a vulnerability scanner is required for standard 6.6. Only FortiWeb offers vulnerability scanning on the same platform. Other manufacturers require separate software or appliances for vulnerability scanning.
• #29: FortiWeb provides enterprise-class web application protection and additional features that make applications secure and easy to manage. At its core, FortiWeb is a WAF with full behavior-based usage profiling and anomaly scanning to protect custom and off-the-shelf applications from known and unknown, zero-day weaknesses. If PCI Compliance is the goal, FortiWeb delivers complete coverage of both PCI DSS 5.5 and 6.6 by covering the OWASP top 10 application vulnerabilities, vulnerability scanning and offers antivirus protection with FortiGuard. A WAF protects applications when they are running. A vulnerability scanner looks for problems in advance so they can be addressed. FortiWeb includes a vulnerability scanner that can be run regularly or as needed to uncover application security threats. FortiWeb’s single-sign on and authentication provide an easy way to publish web applications. It supports any application, including Microsoft applications such as Outlook Web Access. Web-defacement is a problem faced by any organization with an online presence. Should an attacker modify a website, FortiWeb will detect the problem and automatically restore it to the correct version. FortiWeb relies on Fortinet’s industry-leading FortiGuard Labs for things like antivirus, antimalware, attack signatures and IP reputation. All of these assist FortiWeb in detecting known attack types and sources like botnets or attacker IP addresses.
• #30: On the last slide I showed you the results of the NSS Lab’s comparison. For most customers, third party testing is the best way to compare WAFs or any product for that matter. In addition to the performance validations from NSS, FortiWeb stands out from the competition for other reasons too. There are many companies that provide WAF appliances. Fortinet provides an enterprise focused product line that competes against the larger players like Imperva, F5 and Citrix. Barracuda is mentioned often, however most organizations realize that although it performs well, Barracuda is not known for enterprise support and experience. I won’t go through the chart in detail, however I’ll call out that FortiWeb offers competitive throughputs, very high security effectiveness and a very low TCO at $2.77 per protected megabit per second of throughput. When it comes to vulnerability scanning and antivirus, FortiWeb is the only appliance that includes them where others offer them as separate products or services.
• #32: What is a application delivery controller? At its most basic, an ADC is a hardware or virtual appliance that is deployed in a data center that is used to expand applications across multiple servers. These servers can be in the same data center, or in multiple ones anywhere on the globe. ADCs offer tools to check on server and application availability and will automatically route users to the best performing resources, or in the case of outages and disasters, to servers that are online and available. By actively monitoring servers and traffic, the application infrastructure is optimized for increased use of server and network resources, in many cases improving performance up to 25% which can save money by squeezing more out of existing infrastructure elements. These core features are called server load balancing and once implemented in a data center, applications perform better, are more reliable and users see dramatic increases in responsiveness. Sometimes an ADC is referred to simply as a server load balancer, or just load balancer. Earlier models were called load balancers, however in the last 10 years many application performance enhancements have been included and the name has evolved to an application delivery controller. These new features include advanced layer 7 application traffic routing, SSL offloading to improve secure traffic performance, content caching and compression of HTTP application traffic.
• #33: There are 3 primary reasons why an organization needs an ADC. Availability, continuity, and every business needs to reduce costs. Starting with availability, applications need to scale and be responsive to user demand to provide 100% uptime. If an application isn’t there when a user wants to buy a product online, that’s lost revenue to the organization or can drive up costs by forcing a user to call instead of using a low cost fulfillment channel. Continuity is critical for applications. IT professionals demand redundancy and security. Applications need to survive outages and be protected against the latest security threats. Finally, cost reduction. Every organization needs to do more with less and that means getting the most from of their infrastructure investments and reducing IT management costs. So, who needs an ADC? These challenges cut across almost every organization, big or small, if they host their own applications and where web-based applications are core to the business model. In red, the verticals or segments that need it most are e-commerce, online services, financial services, education, healthcare, MSPs and hosting companies.
• #34: Fortinet offers a complete line of hardware and virtual application delivery controllers under the FortiADC brand with L4 throughputs ranging from 1 Gbps to 50 Gbps. Depending on the model, it also includes the latest in high-speed connectivity with up to 8 10-gigabit SFP+ ports. Unlike other competitors, FortiADC offers the features that customers need like global server load balancing, link load balancing and quality of service without the need to buy additional options. Like all ADCs in the market, FortiADC provides layer 4 and 7 server load balancing and advanced content-based routing. All models offer SSL offloading with hardware ASICs included on midrange to higher end models. FortiADC offers class leading performance for almost any application environment from small-to-medium businesses to large-scale data centers. Please note that we strive to maintain accuracy and timeliness of these training deck pages. However, please be sure to check Fortinet.com for the latest models and features.
• #35: As I mentioned earlier, FortiADC is available as a virtual appliance. We offer 4 VM versions with support for up to 8 CPUs. The FortiADC VMs provide the same features and functionality of the hardware-based models, however they provide the flexibility and scale to deploy them as needed without extra hardware and device management. FortiADC VMs provide enterprise-grade ADC capabilities that dynamically expand to meet an organization’s needs with maximum resource efficiency. FortiADCs currently support the VMware ESXi and ESX hypervisors. For more information on FortiADC VM requirements, please see the FortiADC D series datasheet.
• #36: Next lets look at a few of the key technologies offered by FortiADC, starting with server load balancing. The server load balancer is a device that is put in front of servers that manages traffic to and from users. Provided with a single IP address at the front, users access that one address and the server load balancer directs traffic to the servers on other IP addresses associated with that application. Servers are actively monitored for connections, utilization, and even if they’re on or off using health checking. If a server has too much traffic or is down, users are directed to other servers until that server returns to normal or is back in service. Depending on the capacity of the server load balancer, new servers can seamlessly be added to increase capacity to handle even millions of users. If an organization is relying on an older technology like DNS round robin where the DNS blindly routes traffic to the next sequential server, with server load balancing they can achieve up to a 25% increase in server performance.
• #37: The processing of secure SSL traffic can quickly consume server resources and can slow them down 50% or even more. Servers also don’t have the capacity to manage more than a few hundred secure transactions per second. This creates a huge performance hit on the application and response times for end users. By offloading SSL encryption and decryption from the servers to the ADC, the servers get back to serving unencrypted applications and the ADC maintains security to the end users. An ADC can offer software or hardware-accelerated solutions that can handle 10s of thousands of transactions compared to only a few hundred on a single server.
• #38: When an organization only has one datacenter, it’s susceptible to outages. IT managers need redundancy not just for servers or ADC hardware failures, they need to make sure their applications are unaffected by bigger service outages or disasters. Global Server Load Balancing, or GSLB, links two or more ADCs to provide routing of traffic between datacenters. Based on DNS routing, traffic will automatically be sent to a different datacenter should the primary one go down. It can also be used to improve application response times by routing users to the closest data center.
• #39: FortiADC provides enterprise-class application delivery and additional features that make applications reliable, responsive and easy to manage. First and foremost, FortiADC is a server load balancer that allows applications to scale reliably across multiple servers in a data center. Persistence ensures user connections are routed back to the correct server for seamless and transparent continuity of applications. SSL offloading relieves servers from the CPU intensive tasks of decryption and encryption of secure application traffic. HTTP Compression can boost content-rich application performance by up to 5 times by reducing text-heavy things like CSS and HTML. Content-based routing sends traffic to specific servers based on business rules by traffic type. Global server load balancing provides disaster recovery by spanning applications across multiple data centers. Content rewriting minimizes user confusion and masks backend server configurations by simplifying URLs. Quality of Service can be used to prioritize traffic by type to minimize disruptions to applications that are sensitive to latency. Finally, Link load balancing provides ISP redundancy and increases application bandwidth.
• #40: FortiADCs’ main advantage in the marketplace is price to performance. FortiADCs offer a complete lineup of application delivery solutions to meet the needs of almost every segment with price points that provide the lowest TCO per gigabit of L4 throughput. The ADC market is broken out into three primary segments, small, mid-size and enterprise. FortiADC covers all of these markets, however has many more solutions targeted at the upper-mid-size and enterprise markets. In the SMB market, you’ll run into smaller players like Kemp and Barracuda that offer solutions that top out in the mid-market with throughputs of 8 to 10 Gbps. The key players in the enterprise space are F5, the industry leader and Citrix. FortiADCs can’t quite compete with all the higher-throughput options of these competitors, however we do quite well and are the most cost effective solution when it comes to speeds of less than 50 Gbps. FortiADC stands out for a few key reasons. Starting with total cost of ownership, in general FortiADCs are about 30% of the TCO of F5 and Citrix. Fortinet includes everything a customer needs without having to buy option after option to get a solution. That includes GSLB, Link Load Balancing and SSL offloading. We also don’t want you to forget about FortiCare. Our support is just as good as F5 and Citrix, and is much better than smaller players like Barracuda and Kemp, especially when it comes to enterprise solutions.