F5 Herculon SSL Orchestrator, Настройка

Страница: 33 / 58

For security, the DDB facility ensures the destination IP address for each bypassed connection
corresponds to the allowed domain. DDB may replace the destination IP address supplied by
the client with one freshly obtained from DNS.
• For Name (domain name), the Destination you will configure contains one or more DNS
domain names (unique or wildcard) against which the connection's destination host name is
matched.
• From the Type list, depending on which Mode you selected, choose either IP Address , Data
Group , Category , or Domain Name (or there will be no selection required).
• From the Value list or field, depending on which Type and Mode you selected, choose a value
from the list or type in the required information (hover your mouse over the field for tips on
required information).
8. Click Add .
9. From the Service Chain list, select the name of the service chain you configured that you want to use
for this classifier rule. This must be the name you gave a service chain or a special keyword:
• All means a chain including all services: first receive-only services, then ICAP services, then in-
line services.
• Reject terminates the connection.
• Bypass lets the connection go to its destination without traversing any service chain.
By specifying service chain classifier rules, if more than one classifier matches a connection, the best-
matching classifier determines the service chain for that connection (so the order of classifier rules in
the list is not important). Classifiers can also reject a connection or let it bypass the service chain
(bypass TLS interception). The default action applies to connections which do not match any
classifier.
This classifier is the element of the Herculon SSL Orchestrator implementation which selects the
proper service chain to handle each connection. A
connection " is a particular packet flow between
client (source) and server (destination), identified by the 5-tuple of IP protocol (TCP or UDP), plus
client (source) and server (destination) IP addresses and port numbers. The classifier has a set of rules
for TCP connections, and another set of rules for UDP when UDP service chains are enabled. The
classifier matches information describing each connection, such as its client and server IP addresses,
against criteria specified in the classifier rules. For example, a classifier rule might match all
connections from clients homed on a certain IP subnet. Another classifier rule might match all
connections going to servers in a certain country (using IP Geolocation).
10. To bypass decryption and send encrypted traffic to inspection devices, deselect the Decrypt check
box. By default, the Decrypt check box is turned on and cannot be changed unless you have set the
Phase field to Pre Handshake and the Service Chain classifier to All .
Note: If you have upgraded to a new Herculon SSL Orchestrator version, or are using a previous
configuration, the Decrypt check box is selected by default.
11. Click Finished .
12. From the What should happen to unmatched connections? list, select how the system should
handle unmatched connections.
13. Click Save .
You have now created a TCP service chain classifier rule.
Creating UDP service chain classifier rules
Before you create a UDP service chain classifier rule, you must create one or more service chains.
Service chain classifier rules determine which service chains receive traffic. Each service chain classifier
rule selects the specific chain to process ingress connections. Different classifier rules may send
connections to the same chain. Each classifier has three filters that match the source IP address, the
F5 Herculon SSL Orchestrator: Setup
33