Perimeter Protected Access Design Pattern
4 likes1,021 views
This document outlines the design pattern for perimeter application protection in identity access management architecture, focusing on tier 1 solutions. It describes the structure and components of the architectural pattern, which addresses challenges in software engineering like performance limitations and business risk minimization. The implementation involves SSL termination at F5 virtual servers with traffic directed to Oracle OHS for secure access management.
Perimeter Protected Access Design Pattern
- 1. Intranet User “On-Network” Perimeter Protected Access Perimeter Application Protection of Identity Access Management Architecture Design Pattern – Tier 1 Solution Building Block Version: 1.0 Author: Mike Reams Last Modified: DMZ Network Design Pattern Perimeter Application Protection of Identity Access Management A Design Pattern provides a scheme for refining the subsystems or components of a software system, or the relationships between them. It describes commonly recurring structure of communicating components that solves a general design problem within a particular context . Architectural patterns are similar to software design patterns but have a broader scope. The architectural patterns address various issues in software engineering, such as computer hardware performance limitations, high availability and minimization of a business risk. Perimeter Protected Access points to a single Public VIP that terminates the SSL session at the external facing F5 Virtual Server. The back-end interface of F5 from the same session directs traffic to Oracle OHS for reverse proxy which in turns proxies to the internal F5 Virtual Servers configured as Load Balancers using the F5 LTM module. This design is ideal for split DNS to allow internal to go exclusively through the internal F5 Virtual Server while having external traffic route through this architectural pattern. The Oracle WebGate is extended to the perimeter network on the F5 using the Access Policy Manager module. Architecture Domain(s) Networking | Identity Management | Security | Middleware External DNS/VIP External Facing Firewall F5 Big-IP Internal Virtual Server Application Internet User “Off-Network” Linux OHS Reverse Proxy Internal Network Data Web Server Access Manager Access Policy Central Login F5 Big-IP External Virtual Server w/ “APM” If login is required Internal DNS/VIP Internal Facing Firewall Webgate Machine Machine General Architecture If login is required Webgate Internal Facing Firewall