F5 Herculon SSL Orchestrator, Настройка

Страница: 8 / 58

Each service chain classifier rule chooses ingress connections to be processed by a service chain you
configure (different classifier rules may send connections to the same chain). Each classifier rule has
four filters.The filters match source (client) IP address, destination (which can be IP address, IP
Intelligence category, IP geolocation, domain name, domain URL Filtering category, or server port),
and application protocol (based on port or protocol detection). Filters can overlap so the
implementation chooses the classifier rule with the most specifc matches for each connection.
For more information on service chain classifier rules, refer to the Creating TCP service chain
classifier rules section and/or the Creating UDP service chain classifier rules section.
• Service chains
Herculon SSL Orchestrator service chains process specific connections based on classifier rules
which look at protocol, source and destination addresses, and so on. These service chains can include
four types of services (Layer 2 inline services, Layer 3 inline services, receive-only services, and
ICAP services) you define, as well as any decrypt zone between separate ingress and egress devices).
For more information on service chains, refer to the
Creating service chains to link services section.
• SNAT
A SNAT (Secure Network Address Translation) is a feature that defines routable alias IP addresses
that the BIG-IP system substitutes for client IP source addresses when making connections to hosts on
the external network. A
SNAT pool is a pool of translation addresses that you can map to one or more
original IP addresses. Translation addresses in a SNAT pool should not be self IP addresses.
• Sync-Failover device group
A Sync-Failover device group (part of the Device Service Clustering (DSC
®
) functionality) contains
BIG-IP devices that synchronize their configuration data and failover to one another when a device
becomes unavailable. In this configuration, a Sync-Failover device group supports a maximum of two
devices.
• Transparent/Explicit Proxy
You can operate in transparent and/or explicit proxy mode. A transparent proxy intercepts normal
communication without requiring any special client configuration; clients are unaware of the proxy in
the network. In this implementation, the transparent proxy scheme can intercept all types of TLS and
TCP traffic. It can also process UDP and forward other types of IP traffic. The explicit proxy scheme
supports only HTTP(S) per RFC2616. In addition, transparent proxy supports direct routing for
policy-based routing (PBR) and Web Cache Communication Protocol (WCCP) that are dependent on
networking services to support both protocols, while explicit proxy supports manual browser settings
for proxy auto-config (PAC) and Web Proxy Autodiscovery Protocol (WPAD) that require additional
iRule configurations (not included) to provide the PAC/WPAD script content.
Terminology for Herculon SSL Orchestrator
8