F5 Herculon SSL Orchestrator, Настройка

Страница: 16 / 58

• Otherwise, from the list, select the Log Publisher you created. A Log Publisher delivers log
messages to one or more Log Destinations. Log Destinations may include Syslog, ArcSight,
Splunk, and other log servers.
We strongly recommend that you use a Log Publisher for good system performance. The
syslog-ng
service is useful for Errors-only logging but is too slow for Normal or Debug logging when the
system is used in production. A Log Publisher delivers log messages to one or more Log Destinations.
Log Destinations may include Syslog, ArcSight, Splunk, and other log servers as well as the BIG-IP
system's local log database. To use a Log Publisher, it must already be present on the system.
4. From the What kind of statistics do you want to record? list, select the type of statistic the system
records. This implementation can collect usage data for connections, service chains, services, and so
on. The implementation can also record remote domain names and TLS cipher suites for TLS
connections if you wish, but gathering such data consumes more system resources.
Domain names are taken from remote server PKI certificates (or client SNI in the case of Dynamic
Domain Bypass) and may include a wild card. TLS cipher suites may not be recorded when a
connection bypasses interception.
If you choose to collect any statistics, the BIG-IP system starts saving extra data in memory for the
use of integration with performance reporting systems like Splunk or BIG-IP iStats integration.
• Use None if you do not want the system to record statistics.
• Use Usage counters only (No remote-cipher records) to record usage counters only
and not statistics on remote-domain and cipher records.
• Use Usage counters and remote-cipher records (may slow system) to record both
usage counters and remote-domain and cipher records. This option can slow performance on your
system.
5. Click Save .
You have configured logging options and completed the basic Herculon SSL Orchestrator configuration.
Configuring an ingress and egress device on one system
The ingress device is either a device or a Sync-Failover device group where each client sends traffic. The
egress device is either a device or a Sync-Failover device group that receives traffic after a connection
travels through the specified service chain and directs the traffic to the final destination.
If both the ingress and egress traffic are used by the same BIG-IP
®
system, the ingress device is one or
more ingress VLANs where the clients send traffic. The ingress device decrypts the traffic and then,
based on protocol, source, and destination, classifies the traffic and passes each connection for inspection.
If both the ingress and egress traffic are used by the same BIG-IP system, the egress device is one or
more egress VLANs where the clients receive traffic.
1. On the Main tab, click SSL Orchestrator > Configuration .
The General Properties screen opens.
2. If you have only one BIG-IP system, from the Do you want to setup separate ingress and egress
devices with a cleartext zone between them? list, select No, use one BIG-IP device for ingress
and egress .
3. From the Which IP address families do you want to support? list, select whether you want this
configuration to Support IPv4 only , Support IPv6 only , or Both IPv4 and IPv6 .
If you do not choose to support both address families, you must configure IP addresses in the family
you select for all IP address fields in this application. If you choose
Both IPv4 and IPv6 , you can
send intercepted IPv6 traffic through an IPv4 Layer 3 service device.
4. From the Which is the SSL Forward Proxy CA certificate? list, select the Certificate Authority
(CA) certificate that your clients will trust to authenticate intercepted TLS connections.
Setting Up a Basic Configuration
16