Barracuda Networks SSL VPN, Руководство администратора

Страница: 80 / 124

80 Barracuda SSL VPN Administrator’s Guide
The Barracuda Server Agent
The Barracuda Server Agent is a small client that is installed on a machine. Once installed the Server
Agent registers itself with the appliance and then sits idle. It is only when the appliance requires its
assistance does the client wake and begin performing its tasks.
Purpose
The Barracuda Server Agent’s purpose is simply to redirect traffic securely to a target host. As the
diagram below shows, the Server Agent acts as a proxy directing traffic from the appliance to the
remote system.
The administrator is thus able to configure an environment where there is no direct connection to the
end host. For example, a Server Agent can be installed on a remote network and connect back to the
appliance using the standard HTTPS port. With the configuration of routes an administrator can then
set up Resources that access services on the remote network without the need to open up a single port
on the firewall protecting the remote network.
This same process can be used to access resources inside the LAN from a Barracuda SSL VPN
residing in a DMZ.
In the diagram below, the appliance sits in the DMZ with other Internet facing servers. The DMZ is
secured from the Internet with a firewall which only has port 443 open so that the appliance is
accessible. The link from LAN to DMZ is also secured by a firewall. The administrator creates a
Resource, for example a Web Forward to a CRM system; this requires a connection to the CRM
service on the LAN. Instead of opening another port on the firewall between the DMZ and LAN, the
administrator can position a Server Agent on the LAN side with a single port open which the Server
Agent can receive data on.
Routes
A route defines an endpoint host that is associated with a single Server Agent. A Server Agent can be
associated with a number of routes all of which define what endpoints a particular Server Agent can
connect to. When a connection takes place the system determines which Server Agent is associated
with the client’s desired route and contacts that Server Agent passing it all the traffic.