CNS-300-2I Advanced Administration for Citrix NetScaler 9.0 Platinum Edition

Transcription

1 CNS-300-2I Advanced Administratin fr Citrix NetScaler 9.0 Platinum Editin This curse prvides the fundatin t manage, cnfigure and mnitr advanced features and cmpnents f Citrix NetScaler 9.0 Platinum Editin. Interactive discussin and hands-n labs guide learners thrugh advanced administratin tasks such as trubleshting, cnfiguring applicatin security Authenticatin Authrizatin and Accunting fr system management, and cnfiguring Advanced Plicies using service calluts. Advanced mnitring and management tasks such as cnfiguring and using EdgeSight fr NetScaler, Cmmand Center, and NetScaler Web Lgging are als cvered. Prir NetScaler knwledge is strngly recmmended. Audience This curse is intended fr system administratrs r netwrk peratins persnnel, wh cnfigure and administer Citrix NetScaler prducts. Preparatry Recmmendatins Befre taking this curse, Citrix recmmends that learners have the fllwing knwledge and experience: Experience with cnfiguring NetScaler systems, including an understanding f services, virtual servers, and plicies Experience with netwrk devices, such as ruters and switches, varius netwrking prtcls and aspects f applicatin and site architectures (such as DMZs and VLANs) Knwledge f netwrk security threats and site prtectin cncepts such as firewalls, wrms, and DDS attacks Understanding f cncepts related t mnitring and management including basics f SNMP Attended ne f the fllwing curses CNS-200-1I - Basic Administratin fr Citrix NetScaler 9.0 NS-BOA Citrix NetScaler Basic Operatins and Administratin CTX-1730 Citrix NetScaler: Basic Operatins, and CTX-1731 Citrix NetScaler: Administratin Or, equivalent experience with Citrix NetScaler versin 6.1, 7.0, 8.0, 8.1 r 9.0 Key Skills Upn successful cmpletin f this curse, learners are able t cmplete the fllwing: Identify cmmn web attacks and vulnerabilities Write PERL cmpatible regular expressins Cnfigure Citrix Applicatin Firewall 9.0 t prtect web applicatins Trublesht Citrix Applicatin Firewall 9.0 Install and cnfigure Citrix EdgeSight fr NetScaler t mnitr web applicatin perfrmance Install, cnfigure, and use Citrix Cmmand Center t manage NetScaler devices Cnfigure and use additinal advanced features f NetScaler 9.0 including NetScaler Web Lgging, HTTP Callut, and AAA authenticatin fr web applicatins Instructinal Methd This curse is an instructr-led training curse with classrm discussin, demnstratins and the practical applicatin f cncepts thrugh hands-n exercises. Curse Length 5 days Certificatin Preparatin This curse is nt assciated with any current Citrix certificatin prgram.

2 Registratin Fr mre infrmatin and t register fr this curse, please g t Tpic Outline Prvided is the tpic utline fr CNS-300-2I: Advanced Trubleshting Trubleshting Resurces Citrix Knwledge Center Citrix Prduct Dcumentatin Citrix Technical Supprt Cllected NetScaler Data Trubleshting Lg NetScaler System Overview NetScaler Prcesses ncre Cnfiguratin Architecture Built-In Tls Nscnmsg Netwrk Traffic Capture shw and stat Cmmands Reprting Tl Shell Tls Cmmand-Line Interface Tls Cnfiguratin Utility Tls Third-Party Tls Netwrk Prtcl Analyzers Web Brwser Plug-ins SNMP Brwsers FTP Clients Intrducing Applicatin Firewall Applicatin Attacks Applicatin Attack Descriptin Gals f Applicatin Attacks Mst Cmmn Types f Web Applicatin Attacks The Applicatin Firewall Slutin Business Prblems The Benefits f Applicatin Firewall Applicatin Layer Prtectin Psitive Security Mdel Negative Security Mdel Deep Stream Inspectin Adaptive Learning Engine Web Applicatin Vulnerabilities Security Audits and Applicatin Firewalls Payment Card Industry Data Security Standard Imprtance f PCI Cmmn Cding Vulnerabilities PCI-DSS Reprt Packet Prcessing and Inspectin Request Prcess Respnse Prcess Deplyment Cnsideratins Prfiles and Plicies Prfiles Plicies Prfiles and Plicies Prfiles Prfile Types Default Prfiles Creating a Prfile in the Cnfiguratin Utility 2

3 Creating a Prfile in the Cmmand-Line Interface Actin Settings Sessinizatin and Security Checks Prfile Settings Errr Page HTML Cmment Stripping XML Errr Object Other Prfile Settings Plicies Plicy Creatin Plicy Binding Plicy State Plicy Pririties Creating a Plicy in the Cnfiguratin Utility Creating Plicies in the Cmmand-Line Interface Binding and Priritizing a Plicy in the Cnfiguratin Utility Binding Plicies in the Cmmand-Line Interface Engine Settings Regular Expressins Regular Expressins Frms f Regular Expressins Using Regular Expressins Metacharacters and Literal Characters Metacharacters Escapes Quantifiers Backreferencing Lkaheads Regular Expressin Scpe Attacks and Prtectins Security Checks Prfile Types Cmmn Security Checks HTML Security Checks XML Security Checks Request-Side and Respnse-Side Checks HTTPS Web Applicatins Buffer Overflw Explits Gals f a Buffer Overflw Attack Cnsequences f a Buffer Overflw Attack Buffer Overflw Prtectin Default Maximum Values Mdifying Buffer Overflw Settings Parameter Manipulatin Parameter Manipulatin Example Server Miscnfiguratin Deny URL Prtectin The Deny URL List Adding a Deny URL in the Cmmand-Line Interface Deleting a Deny URL in the Cmmand-Line Interface SQL Injectin Hw SQL Injectin Wrks HTML SQL Injectin Prtectin SQL Keywrds and Special Characters Mdifying SQL Injectin Actin Settings XML SQL Injectin Security Check Crss-Site Scripting Attacking the Trust Relatinship Hw Crss-Site Scripting Attacks Wrk 3

4 Results f a Crss-Site Scripting Attack Preventing Crss-Site Scripting Attacks HTML Crss-Site Scripting Prtectin Crss-Site Scripting Actin Settings Transfrm Crss-Site Scripts Check Cmplete URLs fr Crss-Site Scripting Additinal Actin Settings Relaxatins Mdifying Crss-Site Scripting Actin Settings Adding a Crss-Site Scripting Relaxatin Using the Cmmand-Line Interface Deleting a Crss-Site Scripting Relaxatin Using the Cmmand-Line Interface XML Crss-Site Scripting Security Check Cmmand Injectin Cmmand Injectin Examples Field Frmat Prtectin Field Types and Field Frmats Predefined Field Types Custm Field Types Field Frmat Cnfiguratin Default Field Frmat Cnfidential Fields Adding a Custm Field Type Setting a Default Field Type Mdifying Field Frmat Settings Adding a Cnfidential Field Mdifying a Cnfidential Field Ckie Tampering and Pisning Types f Ckies Hw Ckies Are Added Web Server Sessins Ckie Cnsistency Prtectin Sessinizatin and Ckies Relaxatins Adding a Ckie Cnsistency Relaxatin in the Cmmand-Line Interface Deleting a Ckie Relaxatin in the Cmmand-Line Interface Frm/Hidden Field Manipulatin Example f Hidden Field Manipulatin Frm Field Cnsistency Prtectin Field Cnsistencies User Sessins Adding a Frm Field Cnsistency Relaxatin Using the Cmmand-Line Interface Deleting a Frm Field Cnsistency Relaxatin Using the Cmmand-Line Interface Frceful Brwsing Frceful Brwsing Prtectin Start URLs The Start URL List Sessinizatin and Start URLs Mdify Start URL Check Adding a Start URL in the Cmmand-Line Interface Deleting a Start URL in the Cmmand-Line Interface Backdrs and Miscnfiguratins URL Clsure Enfrcing URL Clsure in the Cnfiguratin Utility Enfrcing URL Clsure in the Cmmand-Line Interface Identity Theft Attacks Types f Identity Theft Attacks Applicatin Firewall Prtectin Against Identity Theft Credit Card Prtectin Predefined Credit Cards 4

5 Credit Card Settings Prtecting Credit Cards Prtecting Credit Cards in the Cnfiguratin Utility Prtecting Credit Cards in the Cmmand-Line Interface Errrs Triggering Sensitive Infrmatin Leaks Safe Object Prtectin Defining a Safe Object Adding a Safe Object Adaptive Learning fr Security Learning Over Time Learning Threshlds Generalized and Simple Rules Learned Rules Enabling Learning Setting Learning Threshlds Managing Learned Rules Applicatin Firewall Trubleshting Applicatin Firewall and Applicatins HTTP Headers HTML Cmment Stripping Cnfiguratin Issues Plicy Issues Prfile Issues Suggested Actins Queuing and Cnnectin Tuning HTTP Cnnectins Keep-alive HTTP Cnnectins HTTP 1.0 and 1.1 Behavir Pipelined Requests HTTP Cnnectin Management and NetScaler HTTP Behavir Client Keep-Alive Cnnectin IP Address Cntrl Maximum Requests and Maximum Cnnectins Cnnectin Idle Settings Trackable Cnnectins TCP Buffering Dwn-State Flush and Access Dwn Cnnectin Settings TCP Optimizatin Advertised Windw Size Windw Scaling Selective Acknwledgement Surge Queue Surge Prtectin Request and Respnse Rates Thrttle Rate Disabling Surge Prtectin in the Cnfiguratin Utility Disabling Surge Prtectin fr a Service in the Cnfiguratin Utility Setting Threshlds in the Cnfiguratin Utility Pririty Queuing Enabling Pririty Queuing in the Cnfiguratin Utility Creating a Pririty Queuing Plicy in the Cnfiguratin Utility Binding Pririty Queuing Plicies in the Cnfiguratin Utility Weighted Queuing HTTP Denial-f-Service Prtectin Enabling HTTP DS Prtectin in the Cnfiguratin Utility Adding a HTTP DS Plicy in the Cnfiguratin Utility Challenged JavaScript Respnses Client Detectin Tuning and JavaScript Challenge Respnse Rate HTTP DS Prtectin Deplyment Guidelines 5

6 Attack Characteristics IP Rate Limiting Rate Cntrl by Subnet Example IP Rate Limiting Best Practices Authenticatin, Authrizatin, and Auditing Users, Grups and Cmmand Plicies Authenticatin, Authrizatin, and Auditing Systems and AAA Users Grups Lcal Accunts External Authenticatin External Authenticatin fr System Users Authenticatin Actins and Plicies Cnfiguring Lcal Authenticatin Cnfiguring External Authenticatin with Explicit Accunts Cnfiguring External Authenticatin with Grup Extractin Creating an External Authenticatin Plicy Creating lcal grups in the Cmmand-Line Interface Binding Grups in the Cmmand-Line Interface Creating an LDAP Authenticatin Actin in the Cmmand-Line Interface Creating an Authenticatin Plicy in the Cmmand-Line Interface Binding the Plicy in the Cmmand Line Interface Authenticatin Trubleshting External Authenticatin Cmmn Issues AAA fr Traffic Management Enabling AAA fr Traffic Management AAA fr Applicatin Traffic Basic AAA Setup fr Applicatin Traffic Wrkflw fr AAA Traffic Management Cnfiguratin Creating an Authenticatin Virtual Server Creating an Authenticatin Virtual Server in the Cmmand-Line Interface Binding an SSL Certificate in the Cmmand-Line Interface Binding a Virtual Server t an Authenticatin Plicy in the Cmmand-Line Interface Cnfiguring a Virtual Server t use an Authenticatin Virtual Server in the Cmmand-Line Interface Cnfiguring Authrizatin Plicies fr Traffic Management Setting the Default Traffic Management Authenticatin Actin t Deny in the Cmmand-Line Interface Creating an Authrizatin Plicy t Allw Access Audit Lgging Audit Lgging Trubleshting HTTP Service Calluts HTTP Calluts Cnfiguring HTTP Calluts Cnfiguring HTTP Calluts in the Cnfiguratin Utility Cnfiguring HTTP Calluts in the Cmmand-Line Interface Callut Examples HTTP Callut Respnse Parsing HTTP Callut Use Cases Scenari 1: Filter Clients Based n an IP Address Blacklist Scenari 2: Fetch and Update Cntent HTTP Callut Auditing EdgeSight fr NetScaler Data Flw Overview JavaScript Respnse Injectin User Metrics NetScaler Metrics NetScaler Metric Example 6

7 Data Validity EdgeSight fr NetScaler Server Cmpnents Cmpnent Installatin Scenaris EdgeSight fr NetScaler Installatin Cnsideratins Installing EdgeSight fr Netscaler SQL Server SQL Reprting Services EdgeSight fr NetScaler Cmpnents Installing EdgeSight Database Cmpnents Installing EdgeSight Reprt Cnsle and Data Cllectr Cmpnents EdgeSight Pst-Installatin Wizard Upgrading EdgeSight fr NetScaler Reprting Services Initial Cnfiguratin NetScaler Cnfiguratin Overview Cnfiguring HTML Injectin Editing the prebdy.js script Cnfiguratin Example in the Cmmand-Line Interface Add NetScaler System t EdgeSight fr NetScaler Data Cllectr Tplgy Data Cllectrs with SSL EdgeSight Charts and Reprts EdgeSight Trubleshting Trubleshting OS Cmpnents Trubleshting HTML Injectin Trubleshting Injectin Request Trubleshting Unknwn Device Trubleshting frm the NetScaler Cmmand-Line Interface Cmmand Center Cmmand Center Intrductin Cmmand Center NetScaler Features NetScaler and WANScaler Supprt Cmmand Center Clients Cnnecting t Cmmand Center Server Requirements Disk Space Requirements MySQL Cnsideratins Micrsft SQL Server 2005 Cnsideratins Prt Setting Requirements Cmmand Center Installatin Linux Cnsideratins Installatin Capacity Planning Backup Installatin Mdes Installatin Cnsideratins Cmmand Center Functinality Cmmand Center Hme Page Discvery Fault Management Cnfiguratin Management Change Management Centralized Certificate Management Perfrmance Mnitring Cmmand Center Administratin Security Administratin Administratin Operatins Administratin Cnfiguratin Server Details Cmmand Center Trubleshting Micrsft SQL Database Issues Discvery Issues 7

8 Perfrmance Data Issues Linux Cmmand-Line Interface Access Issues Reprting Issues NetScaler Web Lgging NetScaler Web Lgging Intrductin Architecture Overview Cmmunicatin Prcess NetScaler System Cnfiguratin Enabling Web Lgging in the Cnfiguratin Utility Enabling Web Lgging in the Cmmand-Line Interface Cnfiguring the Buffer Size in the Cnfiguratin Utility Cnfiguring the Buffer Size in the Cmmand-Line Interface NSWL Client Installatin Lgging System Cmpnents Installing the NSWL Client n Windws NSWL Optins Windws Service Registry Key NSWL Client Cnfiguratin NetScaler IP Addresses Lg Filters Defining Lg Prperties Running NSWL Verifying the Cnfiguratin Trubleshting Web Lgging NSWL Trubleshting NetScaler Trubleshting Buffer Overflw 2009 Citrix Systems, Inc. All rights reserved. Citrix, NetScaler, EdgeSight and Applicatin Firewall registered trademarks f Citrix Systems, Inc. in the United States and ther cuntries. All ther trademarks and registered trademarks are the prperty f their respective wners 8