Implementing SSL Offload with JAGUAR Ver.1.0

Transcription

1 JAG C TB SSL Offload v1.0 E Implementing SSL Offload with JAGUAR Ver.1.0 T e c h n i c a l B r i e f What is SSL Offload with JAGUAR 5000 Reverse Proxy? JAGUAR 5000 can change HTTP Web Server s service by HTTPS through SSL Offload setting in Reverse Proxy mode. This offers safe connection to unspecified clients and proves security reinforcement and performance of OCS (Origin Content Server). Together this, it detects computer intrusions such as DoS attack, prevent information leakage of system by Intercepting access that is not admitted, and protect OCS to keep company s property. Followings are advantages when you use SSL offload on JAGUAR 5000 Reverse Proxy mode; Remove load of encryption/decryption by SSL processing of OCS Possible to Authentication and Logging As JAGUAR 5000 caches client s requests, it is possible to reduce load of OCS and raise its efficiency. As IP of JAGUAR 5000 is exposed to the outside instead of OCS s, it is possible to prevent IP of Origin Content Servers and information leakage. As it processes client s request first, it is possible to protect Origin Content Server from malevolent attack like DoS, etc. 1

2 JAGUAR 5000 communicate with client who is weak in security by HTTPS to increase security, on the other hand, uses HTTP to communicate with OCS that is storing in security to reduce OCS s load by SSL encrypting/decrypting. And, as JAGUAR 5000 caches multiple clients requests, it is possible to reduce load of OCS. JAGUAR 5000 SSL Offload Setting 1. Setting as Reverse Proxy 1. After select Reverse Proxy mode on Protocol >> Cache menu of JAGUAR 5000 Web Admin, and then click. 2. Click OK to Cache Restart when following popup window appears. 3. Click Go to cache restart page. 2

3 4. After select Restart >> Software, and then click to cache restart. 5. After change HTTP Port as 80, and then click. 6. After complete apply, restart cache software like step Certificate File Upload 1. Check Enable SSL check box on Protocol>>SSL menu. 2. Browse Authentication File on your PC, and then click Upload button. Then, Authentication File is uploaded on /usr/local/cache/cert.pem directory of JAGUAR After complete upload, click OK to Cache Restart when following popup window appears. 3

4 4. Click Goto cache restart page. 5. After select Restart >> Software, and then click to cache restart. 7. After restarting, confirm Authentication File uploading on CLI of JAGUAR

5 8. Input URL of OCS or IP on Server Name in Protocol >> Cache >> Reverse Host Info menu of JAGUAR 5000 Web Admin, and then click. 5

6 3. Origin Content Server Connecting Test 1. Edit Hosts file on C:\WINDOWS\system32\drivers\etc of Client PC. 2. After complete Hosts file modification and save it. Input Cache IP first, and then OCS URL. 6

7 3. Connect by HTTP. 4. Check real-time log by tail f access.log on CLI of JAGUAR (Check log name on Log>> Log Unit of JAGUAR 5000 Web Admin.) 7

8 (* For information about how to Access Log Enable, refer to JAGUAR 5000 Web Admin User Guide Log.) 5. Connect by HTTPS. 6. Check access.log on CLI of JAGUAR

9 [Appendix] 1. Reverse Host Info setting between Client and JAGUAR 5000 according to Protocol 1.1. HTTP (80) communication between Client and JAGUAR 5000 Process client s HTTP (80) request only, and bypass HTTPS (443) request HTTPS (443) communication between Client and JAGUAR 5000 Process client s HTTPS (443) request t only, but bypass HTTP (80) request HTTP (80) and HTTPS (443) communication between Client and JAGUAR 5000 Process all client s HTTP (80) and HTTPS (443) requests 1.4. If you select HTTP and HTTPS both If you click, after deselect HTTP and HTTTPS check box, following popup window will be shown. If you click OK, both HTTP and HTTPS are selected, and then, these two protocols are processed. 9

10 2. Reverse Host Info setting according to protocol between OCS and JAGUAR HTTP (80) communication between OCS and JAGUAR 5000 If you enter 80 on Port, JAGUAR 5000 communicates with OCS by HTTP HTTPS (443) communication between OCS and JAGUAR 5000 If you enter 443 on Port, JAGUAR 5000 communicates with OCS by HTTPS HTTP (80) and HTTPS (443) communication between OCS and JAGUAR 5000 If Support Dual Protocol is checked, JAGUAR 5000 operates like below when it communicates with OCS. 1. If client communicates with JAGAUR by HTTP, the JAGAUR communicates with OCS by HTTP as well. 2. If client communicates with JAGAUR by HTTPS, the JAGAUR communicates with OCS by HTTPS as well. 10

11 Copyright 2009 ARA Networks Co., Ltd. All rights reserved worldwide. No part of this document may be reproduced by any means nor translated to any electronic medium without the written consent of ARA networks Co., Ltd. Specifications are subject to change without notice. Information contained in this document is believed to be accurate and reliable, however, ARA Networks Co., Ltd. assumes no responsibility for its use. JAGUAR is a registered trademark of ARA Networks Co., Ltd. In the U.S. and worldwide. All other trademarks mentioned in this document are the property of their respective owners. Contact ARA Networks (Fax) 11