CISCO ACE XML GATEWAY TO FORUM SENTRY MIGRATION GUIDE

Transcription

1 CISCO ACE XML GATEWAY TO FORUM SENTRY MIGRATION GUIDE

2 Legal Marks No portion of this document may be reproduced or copied in any form, or by any means graphic, electronic, or mechanical, including photocopying, taping, recording, or information retrieval system without expressed permission from Forum Systems, Inc. Forum Sentry, FORUMOS Firmware, Forum Systems XML Security Appliance, Forum Sentry, Forum Presidio, Web Services Security Gateway, Presidio OpenPGP Security Gateway, Forum FIA Gateway are trademarks and registered trademarks of Forum Systems, Inc. All other products are trademarks or registered trademarks of their respective companies. Copyright Forum Systems, Inc. All Rights Reserved. Forum Systems, Inc. 233 Needham Street Newton, MA Cisco ACE to Forum Sentry Migration Guide M-ACE-FS

3 T a b l e o f C o n t e n t s INTRODUCTION TO MIGRATION GUIDE...4 Audience for the Migration Guide...4 Important Milestones and Dates...4 Migration Approach & Key Guiding Principles...4 Migration Guide Overview...4 MIGRATION STRATEGY...5 Understanding Cisco ACE Production Deployment Topology...5 Deploying Forum Sentry in parallel with Cisco ACE...5 Minimize Impact Surface: Rank Consumers and Backend Services...6 Loading Service into Forum Sentry...6 Backend Simulation...7 Setup policies for selected Consumers...8 Test Services Using SOAPSonar without the Load balancer...10 Production Go Live...10 Backend Transition...10 Register Forum System Endpoint with Load Balancer...10 Gradual Customer Transition...10 APPENDIX...11 APPENDIX A Services Policies Catalog...11 APPENDIX B Network Policies Catalog...12 L i s t o f F i g u r e s Figure 1: Sample Cisco ACE XML Gateway Deployment in Production...5 Figure 2: Parallel Forum Sentry and Cisco ACE Gateway Deployment...6 Figure 3: Consumer to Service Mapping and prioritization...6 Figure 4: Load Backend Service into Forum Sentry...7 Figure 5: Sample Service Library for backend services....7 Figure 6: CloudPort Endpoint Service Simulation....8 Figure 7: Cisco ACE Gateway Request & Response Process Setting for Operations...9 Figure 8: Forum Sentry Tasks to process incoming and outgoing XML, SOAP and JSON messages...9

4 INTRODUCTION TO MIGRATION GUIDE Audience for the Migration Guide The Cisco ACE Gateway to Forum Sentry Migration Guide is for Networking, Security and SOA Managers tasked with installing appliances in corporate networks, maintaining the health of such appliances day-to-day, adding, updating and deleting security policies as new trading partners are brought on line to exchange SOAP, XML, JSON and Web Application messages within the corporation. Important Milestones and Dates Cisco published End-of-Life (EOL) and End-of-Sale (EOS) notices for its ACE XML Gateway with the following important milestones: End-of-Life Announcement Date August 1, 2010 End-of-Sale Announcement Date January 30, 2010 Last Ship Date April 30, 2011 Last Maintenance Release Date January 30, 2012 Impact Analysis: o Cisco ACE Gateway should not be deployed for anticipated increase in traffic in Services with anticipated increase in traffic should be identified and prioritized as early migration candidates. o New trading partners and backend systems should not be deployed on Cisco Gateway in Migration Approach & Key Guiding Principles The base-line migration approach from Cisco ACE XML Gateway to Forum Sentry has the following key guiding principles: o o o o o Minimal, preferably zero customer impact. Gradual policy migration instead of lights-off approach Concurrent operation of Cisco ACE Gateway and Forum Sentry during migration process Leverage exiting IT components: LDAP Server, Syslog, RDMBS Leverage existing policy life-cycle management: Storage, Backup, Versioning and Transfer. Migration Guide Overview The migration guide first details the general tools and techniques used for establishing a migration platform that has minimal impact on customers and provides a clear path and process for incremental migration. Forum Sentry is deployed in the same network along with the Cisco ACE XML Gateways. Optionally, CloudPort a backend service simulation product is deployed where test backend services are not available. If mirrored test and QA systems exist, then they can be used for ensuring that the services are properly loaded into Forum Sentry. SOAPSonar a service-testing tool is used to test the functional and performance characteristics of the policies deployed on Forum Sentry. Existing tools can also be leveraged for testing Forum Sentry. The process of moving a tested set of policies deployed on Forum Sentry is described The migration guide provides the migration steps, Cisco ACE XML Gateway commands and links to related section of the Cisco ACE documentation. It provides sections that cover base policy artifacts such as Keys, Services (WSDL, XML, JSON), Identity Stores, Security Policies, Transport Layer, and Administrative Tasks. Appendices at the end of the document provide a place to capture significant information required for the migration process.

5 MIGRATION STRATEGY In this section, we will cover the migration process in detail. The migration process is designed to be a gradual process policies migrating from Cisco ACE XML Gateway to Forum Sentry over an established transition time window. The steps for establishing a migration strategy are listed below. Understanding Cisco ACE Production Deployment Topology Most XML deployments are behind a network firewall and leverage a load balancer for high availability and fault tolerance. In addition to load balancers on the inbound WAN side, some customer choose to deploy load balancer behind the XML Gateway on the LAN side. Cisco ACE provides Pooling Backend Server to enable load balancing and failover across multiple backend server clusters for the same services. The figure shown below shows a typical deployment scenario with 2 Cisco ACE XML Gateways behind a load balancer with Pooling Backend Server enabled instead of using additional load balancers for the back end servers. Figure 1: Sample Cisco ACE XML Gateway Deployment in Production Test and Development instances of the Cisco ACE XML Gateway are most likely deployed in the network along with the Cisco ACE XML Manager. Most policies should be set on the Manager, tested on the Test Gateway instances and then moved to the production instances of the XML Gateway. Deploying Forum Sentry in parallel with Cisco ACE One of the key tenets of the migration strategy is to lower the migration impact from Cisco ACE to Forum Sentry. With this tenet in mind, it is recommended that Forum Sentry is deployed in parallel with the Cisco ACE XML Gateways as shown in Figure below.

6 Figure 2: Parallel Forum Sentry and Cisco ACE Gateway Deployment A subset of backend servers should be initially transitioned to Forum Sentry based on service selection criteria. Minimize Impact Surface: Rank Consumers and Backend Services To start the migration process, identify low-risk consumers/customers based on Service Level Agreements (SLAs), business relationship with consumer (corporate subsidiary, internal department), or the traffic volume and patterns. The selected list of consumers prioritized from low- to high-risk should then be mapped to the backend services that are being consumed by the XML Gateway. The lowest risk consumer invoking to the least number of backend severs through the gateway should be prioritized higher in as an ideal migration candidate. This consumer to back end service mapping, ranking and prioritization provides a clear understanding migration impact across consumers and back end services. Minimizing the impact surface is a key goal of the migration process. Figure 3: Consumer to Service Mapping and prioritization Typically, a restricted number of IP:Port are assigned to a Gateway. Virtual Services are used to encapsulate backend services. By default, Cisco ACE Gateway creates multiple operation virtual services corresponding to operations in an imported WSDL. An Exposed Path is associated with a Virtual Service as an entry point into the operations. Isolate the Virtual Service and the Exposed Path that minimizes the risk for the selected consumer(s). Loading Service into Forum Sentry All backend services can simply be loaded into Forum Sentry by pointing to the backend server endpoints. Alternatively, CloudPort, a simulation product can be setup to mimic the backend services so that during Forum Sentry configuration and setup, the backend servers are not used and the simulated services are used for testing end-to-end transaction behavior. The CloudPort option is described in the next section. If a fully functional test and QA environment is available for mimicking the backend services, then they can be used instead of CloudPort. Obviously, it is recommended that during initial configuration and setup of Forum Sentry, only simulated or test backend systems be used. Once the end-to-end transaction in complete with the appropriate gateway processing, the backend service can be pointed to the production instances. Figure 4 shows the Service Loading process for Forum Sentry.

7 Add Policy Info Point to Backend Service URI Select WSDL Library for Collection of Operations Figure 4: Load Backend Service into Forum Sentry An alternate approach is to load all the services into a WSDL Library and then expose selected services as part of the new WSDL policy. This approach identifies any loading issues with backend WSDLs upfront. It also enables administrators to select the initial set of operations to be exposed through a Virtual Directory (called an Exposed Path in Cisco ACE). Figure 5 shows WSDL Library being deployed for a new policy where an administrator can select operations to be exposed on a virtual directory. First Backend: trainingsoap (Concat, Divide, Echo, Multiply) Second Backend TempConvertor: (TemperatureC, TemperatureF) Figure 5: Sample Service Library for backend services. Different combinations of operations can be selected and associated with Virtual Directories (Exposed Paths). In the case of non-wsdl based XML or JSON traffic, sample templates can be loaded into Forum Sentry and associated with Virtual Directories for processing before directing to the target backend listener policies. Pointing to Backend Services Deploying a new XML Gateway pointed directly to the production backend server is not a recommend best practice. Test instance of backend services should be used. Most corporations have a fully

8 functional test reference architecture deployed for on-ramp testing for consumers before moving them to production. Some corporation may not have such test environments available. Although it is a best practice to test end-to-end transactions against test instances, it is not always practiced. To lower the threshold of setting up a backend test environment, corporations optionally use CloudPort an end-point service simulation product that enables HTTP, HTTPS, JMS, MQ and Tibco end-points simulation across WS-* and REST type interaction. In CloudPort, the WSDLs and services associated with backend servers are loaded, response expectations for requests are set and the simulation is enable on a selected listener type. Figure 6 shows a sample CloudPort simulation. Figure 6: CloudPort Endpoint Service Simulation. All backend services can be loaded and emulated in CloudPort. Forum Sentry policies point to CloudPort acting as the backend. Once a set of policies is fully vetted out in Forum Sentry, the endpoint can be updated to point to the production backend servers. Note: CloudPort is not a required for the migration process. It is an optional tool recommended for environments that lack test backend services. CloudPort should however be considered as a component of the overall SOA life-cycle process in vetting out any client application. Setup policies for selected Consumers An XML Gateway usually processes the XML, SOAP or JSON message before routing it to the target backend server. The processing may take place on the request or the response. Cisco ACE Gateway and Forum Sentry behave similarly in processing this message content. For selected, low risk customers, once the messaging between Forum Sentry and CloudPort (simulating a backend) is established, the request and response processing rules for the operations shown be reviewed in the Cisco ACE Gateway, as shown in Figure 7. Similar rules can then configured in Forum Sentry. Note that adding policies to Forum Sentry may require modification of CloudPort policies. For example, if a required SAML token in inserted in the message by Forum Sentry, then CloudPort should verify the SAML token to fully mimic the product backend. A clear synchronization of policies between configuration policies on Forum Sentry and CloudPort to mirror the actual production environment.

9 Request and Response Processing Setup Figure 7: Cisco ACE Gateway Request & Response Process Setting for Operations Forum Sentry enables administrators to setup a variety of Tasks within a Task List that can be associated at the operation level or across all operation tied to a virtual directory. Figure 8 shows a sample task list that decrypts contents of a SOAP element. Task to decrypt Contents of Element a Figure 8: Forum Sentry Tasks to process incoming & outgoing XML, SOAP and JSON messages

10 A detailed master catalog of processing tasks and related association with virtual services and operations should be generated. This will help identify candidates for Global Task Lists that can be abstracted for greater ongoing manageability. Baseline resources such as Keys, Security Policies, LDAP policies, User Groups and ACLs, and firewall filtering rules are usually required as a pre-requisite in setting message processing rules. Shell access at the Cisco ACE Manager provides the ability to transition resource information out of Cisco ACE into Forum Sentry fairly seamlessly. Test Services Using SOAPSonar without the Load balancer Once all the processing tasks are configured in Forum Sentry communicating with CloudPort or a nonproduction backend server, a service client tester such as SOAPSonar should be used to send traffic to Forum Sentry. The WSDLs or XML samples generated by Forum Sentry are imported in SOAPSonar. Protocol, identity and security policies are set in SOAPSonar to test end-to-end functionality between client (SOAPSonar), gateway (Forum Sentry) and backend server (CloudPort). Testing should be extended to performance profiling with multiple concurrent connections with potential backend delays emulated in CloudPort. In most deployments, the latency bottleneck is the backend processing delays. This requires the gateway to handle multiple connections while waiting for the backend to complete its processing. With CloudPort, this behavior can be fully modeled. The capacity boundaries for the end-to-end transaction processing can be established before exposing the endpoints to customers. Production Go Live Backend Transition With a high degree of confidence in the end-to-end transaction from the consumer to the simulated backend, the next step is to simply move the endpoints from the backend simulation to the production servers. This is a simple override task within Forum Sentry, where a new Remote Server Policy is now used that points to the production backend servers. Next, using SOAPSonar, invoke a query-type operation to the production backend. Register Forum System Endpoint with Load Balancer Add the Forum System endpoint (URI) to the Load balancer. Once this is done successfully, Forum Sentry acts as an additional XML Gateway within the existing Cisco ACE XML Gateway infrastructure. For the set of operations exposed to a single customer or a group of customers, the invocation is now distributed across both Forum and Cisco XML Gateways with no impact whatsoever to the customer. Gradual Customer Transition Most modern load balancers provide session and client IP Affinity (Stickiness) settings. See for example, Setting Sticky Parameters for Cisco CSS 11050, CSS 11150, and CSS By enabling such settings, traffic originating from select client IP addresses or sessions can be directed towards the Forum Sentry Gateway. This method of traffic shaping provides a clear path towards migrating customers seamlessly towards the newly deployed Forum Sentry. Once all traffic is transitioned to the Forum Systems Gateway, the Cisco ACE Gateway can be decommissioned safely.

11 APPENDIX APPENDIX A Services Policies Catalog QUESTION Percentage of XML, SOAP, JSON ANSWER Number of WSDLs Total Number of Operations Number of Consumers Invoking Cisco ACE Consumer to Service Mapping (Exposed Paths) Number of Key Pairs Typical Tasks per operations (e.g., Signatures, XSLT, XML-SOAP, Firewall) External Identity Store (LDAP, SiteMinder) Auth Tokens Consumed (HTTP, WS-*, SAML, Cookies, Kerberos) Auth Tokens Generated (HTTP, WS-*, SAML, Cookies, Kerberos) Monitoring Systems (Syslog, SNMP, DB) Inbound Consumer Protocols (HTTP, HTTPS, MQ, JMS, TIB) SSL Enabled for Inbound Protocol Producer Protocols Internal Servers (HTTP, HTTPS, MQ, JMS, TIB) SSL Version for Internal Servers (SSLv3, TLS) Transaction Metrics: TPS, Latency, Message Size Range

12 APPENDIX B Network Policies Catalog QUESTION Total Production Cisco ACE Gateways ANSWER Load Balancer Affinity Strategy (i.e None, Least Connections, Client IP) Pooling Backend Server enabled (or network Load balancer) Appliance Mode (Managed, Standalone, Gateway) Default Gateway Custom Routing Rules Local Gateway IP Addresses Exposed Paths (Virtual Directories)