Citrix NetScaler EE, Руководство по установке и настройке

Страница: 378 / 1026

© 1999-2017 Citrix Systems, Inc. All rights reserved. p.378 https://docs.citrix.com
Secure Web Gateway Using GRE Tunnels
Oct 28, 2016
To secure traffic and enforce policies, enterprises backhaul branch traffic to the corporate data center using MPLS links.
The data center applies security policies and filters traffic through security appliances to detect malware, and the traffic is
routed through an ISP. Such backhauling over private MPLS links is expensive. It also results in significant latency, which
creates a poor user experience for users at the branch site. There is also a risk that users will bypass your security controls.
An alternative to backhauling is to add security appliances at the branch. However, the cost and complexity increases as
you install multiple appliances to maintain consistent policies across the sites. And if you have a large number of branch
offices, it becomes impractical to manage costs.
The ideal solution to enforce security without adding cost, complexity, or latency is to route all branch Internet traffic from
the Citrix NetScaler SD-WAN appliance to the Zscaler Cloud Security Platform.
With the addition of Zscaler to your SD-WAN network, you can create granular security policies for users using a central
Zscaler console, and the policies are applied consistently whether the user is at the data center site or branch site. Because
the Zscaler security solution is cloud based, no new security appliances need to be added in the network.
The Zscaler Cloud Security Platform acts as a series of security check posts in more than 100 data centers around the
world. By simply redirecting your Internet traffic to Zscaler, you can instantly secure your stores, branches, and remote
locations. Zscaler connects users and the Internet, inspecting every byte of traffic, even if it is encrypted or compressed.
SD-WAN appliances can connect to Zscaler cloud network through GRE tunnels at the customer’s site. When
implementing Zscaler using SD-WAN appliances, the following functionality is supported:
- GRE traffic forwarding mode only to Zscaler, enabling direct Internet breakout.
- Support for direct internet access (DIA) using Zscaler on a per customer site basis.
- On some sites, you may want to provide DIA with on-premises security equipment and not use
Zscaler.
- On some sites, you may choose to backhaul all traffic another customer site and provide
internet access.
- Virtual Routing and Forwarding deployment.
- One WAN link as part of internet services.
Zscaler is a cloud service and needs to be setup as a service with underlying WAN links defined for the Internet Service that
it uses.
Configure an internet service at the data center and branch through GRE events.
Create a trusted Public internet link configured at the data center and branch sites.
Topology