Safe Financials Limited. The CREST Simulator. File Transfer Overview and SFL Gateway

Transcription

1 Safe Financials Limited Ascension House 2 nd Floor First Avenue Burton on Trent DE14 2WW Tel : Web : enquiries@safefinancials.co.uk The CREST Simulator File Transfer Overview and SFL Gateway A document including: An overview of file transfer An overview of the SFL CREST SimGateway application Secure file transfer options and description The SFL program manager Date Author Status Approved by Approved Internal / Document Name Date External 29/10/04 Mark Brown Release External SFL CREST SimGateway Overview.doc

2 CONTENTS CONTENTS 2 INTRODUCTION 3 Simulator Overview 3 FILE TRANSFER OVERVIEW 4 Overview 4 Test System Connectivity 4 Gateways and Connections 4 Single Gateway Setup 4 Multiple Gateway Setup 5 Multiple Connections Setup 5 File Transfer Protocols 6 Plain FTP 6 Firewall Port Requirements for FTP 6 SSL Enabled FTPS 6 Firewall Port Requirements for FTPS 6 Secure Shell SFTP (SSH2-SFTP) 7 Firewall Port Requirements for SFTP 7 Connectivity Options 7 SFL CREST SIMGATEWAY APPLICATION 8 Program Views and Modes 8 THE SFL PROGRAM MANAGER 11 Overview 11 Automatic Updates 11 SimGateway Monitoring and Start-up 11 The anatomy of the SFL Program Manger 11 CONFIGURATION 13 INI Files 13 File TranSfer Overview File Transfer Protocols Page 2 of 13

3 INTRODUCTION Simulator Overview The CREST Simulator mimics the live CREST environment including the secure networks provided by Swift, Syntegra and the LSE. The main difference is the Simulator service is supplied over the internet rather than through a private network. Although the customer may provide their own solution for file transfer, the majority of SFL s customers utilise the SFL CREST SimGateway. The SFL CREST SimGateway is a Windows application that manages the transfer of files between local and remote locations. This document provides an overview of that application. File TranSfer Overview File Transfer Protocols Page 3 of 13

4 FILE TRANSFER OVERVIEW Overview The basic objective of the file transfer software is to transfer files from one local location to another remote location using a file transfer protocol. SFL have developed the SFL SimGateway application to transfer files using the following methods; Swift : In and out directories Syntegra : Transmit/receive directories LSE : Various To facilitate all customers, the SFL software is highly customisable. It can be easily configured for most setups. Within the CREST environment, the SFL software picks up files from the test system and sends them to SFL. The SimGateway then picks up the processed files and deposits them back on the test system waiting for them. Test System Connectivity The SFL SimGateway sits on a Microsoft Windows PC 1 and connects to the customers test system or environment through the following methods; Shared, or mapped drive presented on the Windows PC The SimGateway is configured with the mapped drive path for its local files. NFS presented as a shared drive on the Windows PC As above. FTP The SimGateway application is configured to handle two connections (gateways). One connection/gateway manages the transfer of files between the local pc and the remote test system. The second connection/gateway manages the transfer of files between the local pc and the remote CREST Simulator service. Gateways and Connections Each local to remote connection process is termed a Gateway. The SFL application is used to transfer files between one or more customer test systems using one or more configured gateways. Single Gateway Setup The normal installation includes the SFL application controlling one gateway. This gateway controls the transfer of files between the customer and SFL. The following diagram depicts a single gateway, single connection environment: 1 The software support, Windows 2000, 2000 Server, 2003 server, XP and fully patched versions of NT workstation and server. File TranSfer Overview File Transfer Protocols Page 4 of 13

5 Single test system connection with mapped /NFS drive to back office connection Client controlled FTP to SFL INTERNET Client controlled FTP to SFL Workstation running SFL CREST SimGATEWAY 1 Gateway for 2SFL Process Customer Firewall Opened ports : FTP / SFTP / FTPS SFL Firewall Opened ports : FTP / SFTP / FTPS SFL SECURE FILE TRANSFER PORTAL ftp.safefinancials.co.uk BACKOFFICE TEST SYSTEM E.g. FIGARO, GLOSS, FISCAL, TAROT Multi-user testing system SHARED DRIVE/NFS ACCESS to CREST FILE DIRECTORIES SFL CREST Simulator Environment IBM iseries Multiple Gateway Setup In some cases, the file transfer process between the test system and the SFL CREST Simulator can only be achieved through the use of multiple gateways. One gateway is configured to transfer the files from the back office system and a second gateway to transfer the same files to the remote SFL CREST Simulator internet portal. The running application will manage the transfer of files for both gateways. The following depicts a single connection, multiple gateway set-up: Single test system connection with additional FTP Gateway to back office SFL CREST SimGATEWAY 2 Gateways managed. 1=To-Backoffice 2=To-SFL Client controlled FTP to SFL GATEWAY 2 To- SFL Process GATEWAY 1 : To-Backoffice process Customer Firewall Opened ports : FTP / SFTP / FTPS INTERNET Client controlled FTP to SFL SFL Firewall Opened ports : FTP / SFTP / FTPS SFL SECURE FILE TRANSFER PORTAL ftp.safefinancials.co.uk BACKOFFICE TEST SYSTEM E.g. FIGARO, GLOSS, FISCAL, TAROT Multi-user testing system FTP to BO File stored locally on worksations SFL CREST Simulator Environment IBM iseries Multiple Connections Setup The CREST Simulator and CREST SimGateway can support multiple customer environments. I.e. concurrent CREST Simulation for the following environment uses; Unit test System test UAT (user test) Pre-production test Training and other environments The same file transfer application can be used to control the entire process. File TranSfer Overview File Transfer Protocols Page 5 of 13

6 Multiple connections to the Simulator SFL CREST SimGATEWAY Gateway 1 : UAT 2 Gateways - UAT - Training Gateway 1 Gateway 2 Gateway 2 : TRAINING Customer Firewall Opened ports : FTP / SFTP / FTPS INTERNET SFL Firewall Opened ports : FTP / SFTP / FTPS SFL SECURE FILE TRANSFER PORTAL ftp.safefinancials.co.uk UAT TEST SYSTEM TRAINING SYSTEM SFL CREST Simulator Environment IBM iseries File Transfer Protocols The normal protocol for file transfer between systems is FTP. This is a simple protocol used to send files internally or across WANs. The only drawback with FTP over the Internet is that the communications are unsecured and are authenticated using plain text (unencrypted). However, for test systems, this is not a problem as the data being transmitted is fictitious test data. Although the majority of Simulator customers utilise normal FTP, some organisations no longer allow insecure file transfer. It is for that reason that the following protocols are supported by SFL. Plain FTP The straight forward unsecured file transfer protocol. Firewall Port Requirements for FTP The customer must allow outbound connections to the following IP ports; 20 and 21 for FTP to for passive mode ports SSL Enabled FTPS Secure Socket Layer (SSL) is a protocol for encrypting and decrypting data across a secure connection from a client to an SSL enabled server. In SFL s case, the SSL-enabled server is our secure FTP server. The process is secured through the use of digital certificates. The SFL SimGateway and secure FTP server supports both Explicit (Turn on) and Implicit (Always on) SSL negotiations. Firewall Port Requirements for FTPS The customer must allow outbound connections to the following IP ports; 20 and 21 for FTPS 990 for implicit SSL to passive mode ports File TranSfer Overview File Transfer Protocols Page 6 of 13

7 Secure Shell SFTP (SSH2-SFTP) The industry standard for secure access to remote systems. SSH2 is a protocol that combines strong authentication and encryption processes to allow various functions. The SFL SimGateway and secure FTP server utilises the SFTP subprotocol. This protocol is very similar to FTP in that it is used to transfer files between sites. The SSH and SFTP protocol utilises public and private keys. The server will only allow access from clients with known public keys. SFTP is much easier to route through a firewall as only one IP port is used. Firewall Port Requirements for SFTP The customer must allow outbound connections to the following IP ports; 22 for SSH2 Connectivity Options The majority of our customers utilise the Internet to connect through to our servers. However, in some cases we can support IPSEC VPN connections through our firewall. Once connected through a VPN, the same choice of protocols remain as described previously. File TranSfer Overview File Transfer Protocols Page 7 of 13

8 SFL CREST SIMGATEWAY APPLICATION Program Views and Modes This is the default running mode. It shows the key status information. Mini Mode View Stats and summary information Click to cycle through stats Start / Stop Green=Running Red=Stopped Maximise Screen Switch to Max view Current action Click to view file sizes Error light Click error text to view last error and clear the light Scanning/Retrieving status Click to view file sizes Secure session icon When the max button is clicked, the following main screen is displayed. The orange buttons along the top row change the view. Max View : Logging Program Views Support page Mini mode information Log details Colour coded for severity Clear screen Log View Log file All logging is also sent to a text file in the history directory Log options File TranSfer Overview File Transfer Protocols Page 8 of 13

9 Max View : File history File send, 2 to do Mini mode showing file send in progress File details Sent/received files. Click to view file contents Clear history Summary Examines all directories to show Overall status. I.e. no to send etc Max View : Gateway Configuration : LOGIN Details Stats field showing summary over last 10 mins Gateway configuration sub - views Login : Login details. Primary/secondary switch, secure config etc To remote: Transfer to remote site options From remote : Transfer from remote site options Misc options: Overall configuration options Operators : CREST operators for file transfer process File TranSfer Overview File Transfer Protocols Page 9 of 13

10 Max View : Program Configuration : File & Directory Program configuration sub-views File & Directory : Various options for controlling files. E.g. creating all operator directories Misc options: Autoupdate and shortcuts for viewing the INI files FTP transfer Options: Stats for the FTP process Time and schedule: Overall time options. E.g. schedule and operators timeslices File TranSfer Overview File Transfer Protocols Page 10 of 13

11 THE SFL PROGRAM MANAGER Overview The program manger application performs the following two tasks; Perform automatic updates Monitors and controls the starting and stopping of the SimGateway The program manger is configured from its own INI file found in the configuration directory. SFL_PGMmanager.ini Automatic Updates The SimGateway application can be configured to look for updates to itself and components. These components are automatically downloaded. The SFL Program Manger application will find these updates and prompt the user if it should apply the updates or not. SimGateway Monitoring and Start-up The program manger can be configured to start up multiple applications including SFL and none-sfl applications. The application will then monitor the status of the invoked application to ensure that the program has not crashed or has been stopped. If the program manager detects that an application has failed, it will be terminated and restarted. The anatomy of the SFL Program Manger The following are screen shots of the main screens; SFL Program Manger Log view File TranSfer Overview File Transfer Protocols Page 11 of 13

12 SFL Program Manger Process view SFL Program Manger Config view File TranSfer Overview File Transfer Protocols Page 12 of 13

13 CONFIGURATION INI Files The SFL SimGateway and SFL Program Manager applications are configured through the use of INI files. The INI files are read when the program starts and configure the program and all their sub processes/gateways. The programs do not update their own INI files. This means that any changes to the running program will be lost should the program be closed down and restarted. SFL will provide the customer with a working configuration based on the completed registration document. SFL are always on hand to help with any configuration changes. File TranSfer Overview File Transfer Protocols Page 13 of 13