f5 Global Access
f5 Global Access
f5 Global Access
by Peter Silva
Technical Marketing Manager, Security
White Paper
Secure, Optimized Global Access to Corporate Resources
Contents
Introduction 3
Global Implementation 9
Gaining Access to the Resources 9
Real-World Scenarios 11
Conclusion 14
2
White Paper
Secure, Optimized Global Access to Corporate Resources
Introduction
The mobile workforce is expected to increase from 919 million in 2008 to 1.2 billion
in 2013—a figure that will represent 34.9 percent of the worldwide workforce.1
Workers are dispersed all over the globe, and they use a variety of trusted and
un-trusted devices to request access to corporate resources from different types of
networks. Users need fast, secure, and reliable access to the corporate infrastructure;
but IT departments are struggling with multi-vendor access solutions and systems,
policy enforcement, access regulation, security threats and vulnerabilities, and
ensuring that the right user is connecting to the right applications based on context.
If all that weren’t enough, IT departments must also keep management and
maintenance costs in line. Enterprises need unified and converged access and policy
management in a globally distributed environment, so they can connect any user
on any device from any location to the application, wherever it lives, securing and
optimizing content delivery.
The days of expensive, single-point products that only provide an isolated solution
are waning, and customers are now looking to consolidate their deployments for
easier management and better return on investment (ROI) and lower total cost of
ownership (TCO). Unified, optimized, and secure access is what organizations and
their users and customers need—and F5 has the unified access solutions to deliver it.
At the same time, the origin and destination of traffic rarely stay static over time.
As flows change, the strategic points of control often cannot adapt dynamically and
thus become impediments to efficient flow. As roadways become highways, the
3
White Paper
Secure, Optimized Global Access to Corporate Resources
previously adequate control point (such as the simple stop sign) can become a
dangerous bottleneck or worse. But the process of changing the type or function
of a control point to meet the new demands can be long, complicated, and costly.
Today, IT departments require control points that can adapt dynamically and secure
content and applications as they are delivered from a variety of locations to a
multitude of users. This is especially true for global infrastructures that span the
cloud and the data center. Many users are on the move, and they are accessing
applications and content that may be on the move as well, from data center to
cloud and back again; therefore a central policy control point is critical to managing
these dynamic environments. When a control point is decentralized, IT has limited
control over the flow of data. There is no contextual information with which to
make intelligent decisions; and change control becomes difficult and error prone,
and removes the simplicity and flexibility needed for global access deployments.
Unified access control is about securing and optimizing the delivery of applications
globally to remote users by connecting them with the least amount of latency and
as close to the application as possible.
When users are all over the world, globally distributed access across several data
centers can help solve access and availability requirements—but both the user
base and IT administrators still need a solution that is easy to use and manage.
Application and access security solutions should provide centralized, strategic points
of control. These Application Delivery Controllers (ADCs) are often located at the
edge of the network, whether it’s in-house or in the data center. The strategic
points of control, positioned between users and the resources they need, can
make intelligent decisions about how to handle access traffic. The F5® portfolio
of application delivery and unified access products, including BIG-IP® Local Traffic
Manager™ (LTM), BIG-IP® Access Policy Manager™ (APM), and BIG-IP® Edge
Gateway™, provides the security, scalability, and optimization required for unified
global access to corporate resources in all types of deployment environments. By
4
White Paper
Secure, Optimized Global Access to Corporate Resources
converging and consolidating remote users, LAN access, and wireless junctions
within a single management interface, and providing easy-to-manage access policies,
organizations can save money and free up valuable IT resources. F5’s unified access
solutions secure an infrastructure from within by creating a place in the network to
provide security, scalability, optimization, flexibility, context, resource control, policy
management, reporting, and availability for all applications.
In the traditional IT model, resources, users, and access methods were controlled by
IT. Relationships among users, applications, and data were static and tightly bound;
and applications were written with specific display layouts in mind. As remote and
then mobile users were added, along with partners, contractors, and guests, and as
IT was distributed globally, the traditional model broke down. In today’s complex IT
security world, it is not enough for an organization to simply know who is accessing
their data and applications. Organizations must also know what device, what type
of network, and which resources users are requesting. It’s also critical to know
whether the requested servers, networks, and applications are available and secure.
With advanced dynamic control for universal global access, organizations can
oversee the complexity and unpredictability of all these moving parts.
However, the closest location might not always be optimal for that particular user
at that moment. Consider this scenario: A typical UK user’s requests are usually
delivered from the UK data center location, but unbeknownst to the user, the UK
location is experiencing availability issues. Working in concert, the components of F5
unified access solutions are aware of the issues and will automatically reroute the
user to the nearest optimal data center or cloud deployment.
5
White Paper
Secure, Optimized Global Access to Corporate Resources
Another scenario involves a data center outage that occurs while the user is
downloading a file from that location. Even in this instance, F5 unified access
solutions can retrieve the file from another location and fulfill the request as
expected. The user is likely unaware of the reroute, and unlikely to care as long as
they can get to their resources quickly and efficiently. Availability is a key metric
when delivering applications to a global user base—one that F5 unified access
solutions can help organizations achieve.
6
White Paper
Secure, Optimized Global Access to Corporate Resources
identifiers like: what they say, what they know, where they are, what they share,
who they know, and their preferences, choices, reputation, profession, or any
combination of these that is unique to the user.
Unauthorized access to systems is a huge concern for companies, not only because
of the potential disclosure and loss of confidential company data, but because of
the regulatory compliance risks. It is critical to every business that only authenticated
users gain admission to their networks, and that those users access only the
resources they are authorized to see. In an enterprise infrastructure, authentication,
authorization, and accounting (AAA) services is the primary method deployed to
verify user identity. These systems can be complex, and managing AAA services in
a web application deployment can be costly.
There are a number of ways to authenticate web users: some organizations code
authentication right into the application during development; others install agents
on the servers; and many have specialized access proxies. All of these methods
aredifficult to manage and change, and they are not particularly interoperable. They
can become costly in regard to both deployment and management since they’re
decentralized and every server needs individual attention. These methods can be
not secure or scalable enough for a global workforce, and they may also overlook
authorization and accounting, which are often required for regulatory compliance.
With VPE, administrators can easily create and manage security policies and
resources, and VPE’s flowchart-style design shows exactly what types of inspections
are enabled. This gives administrators complete control over which resources get
delivered to which user or group of users, and enables them to control access based
on device and identity. With dynamic, per-session L4 and L7 access control lists,
7
White Paper
Secure, Optimized Global Access to Corporate Resources
Administrators can enable multiple domain SSO solutions if certain users need
access to multiple separate domains or multiple hosts within the same domain.
VPE also supports Kerberos ticketing, which provides easy authentication design for
Active Directory implementations, and it consolidates all authentication management
in one Kerberos Protocol Transition (KPT) solution. Users enter their credentials only
once to access resources that are spread across a distributed architecture, boosting
productivity and simplifying login.
In the case of web application authentication, organizations can use BIG-IP APM
to replace specialized access proxies or agents and gain superior scalability and
high availability. They can also initiate an endpoint host inspection for any client
requesting access to their web application, whether it’s public or internal, to ensure
a minimum security posture and enforce stronger authentication than is typically
available for web applications. If a situation arises in which the organization needs
to provide authentication and client validation prior to granting access to unsecured
applications, secure authentication can be added. This authentication method is
8
White Paper
Secure, Optimized Global Access to Corporate Resources
used first to create a secure session and then to provide access to the services
behind it. For instance, an organization may not want to lock down its public-facing
website, but certain requests may require authentication (for example, if a user
requests access to a restricted folder). With secure authentication, administrators
can manage web application access efficiently; anyone can navigate the main page,
but when the user clicks a “member” area, access controls raise the gate.
Global Implementation
Gaining Access to the Resources
In today’s distributed architectures, applications and resources may be spread
around the globe depending on an organization’s needs. For example, its financial
applications might be in-house, email hosted in the cloud, and CRM and ERP
systems at a data center—and each installation has its own disaster recovery or
backup site. Applications may move from the data center to the cloud during
traffic spikes, and then back to the data center when traffic normalizes. If users
are mobile and requesting applications that are also in motion, the efficient
delivery of content could pose a challenge.
With dynamic access control, managing resources has never been easier.
Administrators can create a single policy for all access methods or create unique
policies depending on access method, device, user group, or other benchmarks.
The resources themselves may be circulating throughout the infrastructure, but
with specific application access criteria tied to them. Depending on host inspection
results, administrators can grant full, some, or no access to the requested asset. An
employee requesting access from their IT-issued laptop might get a full network
access tunnel, but from their home computer, they might get restricted or limited
access. Contractors or partners may have access to a certain network segment or
terminal servers during business hours, but if they try to access the system after
hours, they might only be able to access a dynamic webtop with only web-based
applications available, for instance, ERP and CRM applications. This means that even
if users and resources are in transit, the access policy will always still apply.
With users and resources globally distributed and often on the move, latency can
also be a challenge. Ideally, users’ requests would be addressed immediately—but
this can be tricky with users and applications on opposite sides of the globe. The
varying location and network of both users and applications can cause issues like
latency, packet loss, and poor performance, which can have a detrimental effect
9
White Paper
Secure, Optimized Global Access to Corporate Resources
Quality of service, particularly with VoIP, is another challenge for mobile and
remote users. BIG-IP Edge Gateway offers a Datagram TLS (DTLS) mode for remote
connections. TLS is the standard protocol used for securing TCP-based Internet
traffic (also known as SSL); and DTLS is a protocol based on TLS that can secure the
datagram transport. It is well-suited for securing and tunneling applications that are
delay-sensitive. This solution reduces the required hardware in locations that may
have delay-sensitive networks; provides effective application access management;
and greatly improves user experience.
There may be instances based on user identity, security implications, or other criteria
in which a full layer 3 tunnel is not appropriate or the user simply needs to access a
single application, for example Exchange with their local Outlook client. In these
situations, rather than granting full network access, a single F5 AppTunnel might be
more suitable. AppTunnels allow organizations to create a single secure link to a
specific application without having to open up full network access, so mobile users
can simply click their Outlook client to get secure access to their email, no matter
where they are in the world. AppTunnels are also completely WAN-optimized so
10
White Paper
Secure, Optimized Global Access to Corporate Resources
Real-World Scenarios
Many companies are deploying Microsoft Exchange Server 2010 or migrating from
Exchange 2007 to Exchange 2010. Upgrading any system is a challenge. Transitions
come with a host of potential problems: some users may be on the old system and
some on the new; users may be temporarily unable to access email; administrators
and users might need to change their Outlook client server settings to make sure
they are pointed to the proper server; replies to certain messages may bounce; the
OWA URL may change; and calendars may be unavailable.
Deploying F5 unified access solutions can alleviate many of the issues associated
with an Exchange migration. First, the F5 solutions allow organizations to migrate
over time while BIG-IP APM authenticates users in the DMZ to ensure there are no
unknown users accessing the system. Organizations can distribute a single URL, and
depending on the user or group, BIG-IP APM will direct the user to the appropriate
server for any Exchange iteration (OWA, ActiveSync, or Outlook Anywhere). This
gives users direct access to email without requiring that they update bookmarks or
other settings. Organizations can also manage email access for all devices, from all
Mobile Users
Internet
Branch O
Office
Offi
Offic
ffi
fi Users
BIG-IP LTM
+ APM
VDI VDI VDI
11
White Paper
Secure, Optimized Global Access to Corporate Resources
locations, and on any network. After migration, F5 unified access solutions can
scale to accommodate 600 logins per second, and support up to 60,000 users on
a single appliance. Enabling hosted virtual desktops is also simple and secure.
The addition of the fine-grained access control in BIG-IP APM to BIG-IP LTM is a
powerful enhancement to any virtual desktop deployment. BIG-IP APM optimizes,
secures, and delivers a Virtual Desktop Infrastructure (VDI). The BIG-IP system
improves availability and scalability by providing important load balancing, health
monitoring, and SSL offloading for VDI deployments. Network and protocol
optimizations help organizations manage bandwidth efficiently and in some cases,
reduce the bandwidth requirements while maintaining and improving the user
experience. BIG-IP APM also enables organizations to make virtual server load
balancing decisions based on user identity, ensuring that users are connected to
the optimal virtual instance based on their needs.
BIG-IP APM for LTM Virtual Edition (VE) can also be a 100-percent virtual remote
access solution for VDI solutions, and it can be deployed as part of a hybrid cloud
or disaster recovery strategy. In addition, BIG-IP APM for LTM VE will run as a virtual
machine in a VMware hypervisor environment so organizations can easily add it to
their existing infrastructure. As the number of users on virtual desktops grows,
customers can easily transition from virtual to physical editions of BIG-IP products.
BIG-IP APM for LTM VE simplifies authentication and session management for VDIs.
12
White Paper
Secure, Optimized Global Access to Corporate Resources
13
White Paper
Secure, Optimized Global Access to Corporate Resources
Conclusion
The mission is to connect any user from any device from any location to wherever
the application lives, securing and optimizing the delivery of content. Unified access
control can help an organization optimize secure application delivery to remote
users around the world by connecting them as close to the application and with
as little latency as possible.
If organizations have cloud deployments, BIG-IP APM for LTM VE enables them
to achieve complete, optimized, secure connectivity in a virtualized environment.
F5 unified access solutions secure a global infrastructure by providing security,
scalability, optimization, flexibility, context, resource control, policy management,
reporting, and availability for all applications from that strategic point of control
within the network.
i
IDC Report, “Market Analysis: Worldwide Mobile Worker Population 2009–2013 Forecast”. December 2009,
IDC #221309, Volume 1.
F5 Networks, Inc. 401 Elliott Avenue West, Seattle, WA 98119 888-882-4447 www.f5.com
© 2011 F5 Networks, Inc. All rights reserved. F5, F5 Networks, the F5 logo, BIG-IP, ARX, FirePass, iControl, iRules, TMOS, and VIPRION
are registered trademarks of F5 Networks, Inc. in the U.S. and in certain other countries. CS01-00056 0611