F5 Herculon SSL Orchestrator, Настройка

Страница: 7 / 58

Terminology for Herculon SSL Orchestrator
Terminology for Herculon SSL Orchestrator
This section defines some of the terms used in this document.
• Certificate Authority (CA) certificate
This implementation requires a Certificate Authority PKI (public key infrastructure) certificate and
matching private key for SSL Forward Proxy. Your TLS clients must trust this CA certificate to sign
server certificates.
• Decrypt zone
A decrypt zone refers to the network region between separate ingress and egress BIG-IP
®
devices
where cleartex data is available for inspection. Basically an extra inline service can be placed at the
end of every service chain for additional inspection. You cannot configure a decrypt zone in the
scenario where a single BIG-IP system handles both ingress and egress traffic because the decrypt
zone does not exist.
• Egress device
The egress BIG-IP system is the device (or Sync-Failover device group) that receives the traffic after
a connection traverses the chosen service chain and then routes it to its final destination. In the
scenario where both ingress and egress traffic are handled by the same BIG-IP system, egress refers to
the VLAN(s) where traffic leaves the BIG-IP system to the Internet.
• ICAP services
Each ICAP service uses the ICAP protocol (https://tools.ietf.org/html/rfc3507) to refer HTTP traffic
to one or more Content Adaptation device(s) for inspection and possible modification. You can add an
ICAP service to any TCP service chain, but only HTTP traffic is sent to it, as we do not support ICAP
for other protocols. You can configure up to ten ICAP services using F5
®
Herculon
™
SSL
Orchestrator
™
. For more information on ICAP services, refer to the Creating ICAP services section.
• Ingress device
The ingress BIG-IP system is the device (or Sync-Failover device group) to which each client sends
traffic. In the scenario where both ingress and egress traffic are handled by the same BIG-IP system,
ingress refers to the VLAN(s) where the client sends traffic. The ingress BIG-IP system (or ingress
VLAN(s)) decrypts the traffic and then based on protocol, source, destination, and so on, classifies it
and passes each connection for inspection based on service chains you will configure (or allows
certain connections to bypass service-chain processing based on your selections).
• Inline services
Inline services pass traffic through one or more service (inspection) devices at Layer2 (MAC)/Bump-
in-the-wire or Layer3 (IP). Each service device communicates with the ingress BIG-IP device over
two VLANs called
Inward and Outward which carry traffic toward the intranet and the Internet
respectively. You can configure up to ten inline services, each with multiple defined devices, using
Herculon SSL Orchestrator.
• Receive-only services
Receive-only services refer to services that only receive traffic for inspection, and do not send it back
to the BIG-IP system. Each receive-only service provides a packet-by-packet copy of the traffic (e.g.
plaintext) passing through it to an inspection device. You can configure up to ten receive-only
services using Herculon SSL Orchestrator. For more information on receive-only services, refer to the
Creating receive-only services for traffic inspection section.
• Service chain classifier rules