F5 Intelligent DNS Scale. Philippe Bogaerts Senior Field Systems Engineer mailto: Mob.:

Transcription

1 F5 Intelligent Scale Philippe Bogaerts Senior Field Systems Engineer mailto: Mob.:

2 Intelligent and scalable PROTECTS web properties and brand reputation IMPROVES web application performance and browsing DIRECTS customers to the best data center or cloud LOWERS stress of outages REDUCES data center costs F5 Networks, Inc 2

3 Internet foundation? DEMANDS DOMAIN NAME SYSTEM () Translates a domain name More people Mobile devices/apps Complex sites Increased latency into an IP address: (IPv4) = 2001:19b8:101:2::f5f5:1d (IPv6) Cloud implementations IPv6 added to IPv4 DDoS attacks WHEN BREAKS, EVERYTHING BREAKS F5 Networks, Inc 3

4 What is driving this demand for? Available and protected AVERAGE DAILY LOAD FOR (TLD) QUERIES IN BILLIONS TYPICAL FOR A SINGLE WEB PAGE TO CONSUME 100+ QUERIES FROM ACTIVE CONTENT, ADVERTISING, AND ANALYTICS GLOBAL MOBILE DATA (4G/LTE) IS DRIVING THE NEED FOR FAST, AVAILABLE 18X Growth G LTE Non-4G LTE 2.4GB /mo 86MB /mo SEC DEPLOYMENT EXPANDING ATTACKS ON BECOMING MORE COMMON; SERVICES MUST BE ROBUST DISTRIBUTED, AVAILABLE, HIGH- PERFORMANCE GSLB FOR MULTIPLE DATA CENTERS Reflection/amplification DDoS Total service availability Cache poisoning attacks Geographically dispersed DCs Drive for SEC adoption capacity close to subscribers F5 Networks, Inc 4

5 Critical: 5 SECONDS 74% are willing to wait 5 seconds or less for a single web page to load before leaving the site 2007 has grown over 100% in the last 5 years Every 100ms delay costs Amazon.com 1% in sales % As of October 2012, there were over 188 million active websites, a growth of 180% over the last 5 years F5 Networks, Inc 5

6 Traditional LOAD BALANCED Scale by adding more servers Individual servers are not high performance, so scale with load balancing Place firewall in front of infrastructure ISSUES WITH THIS DEPLOYMENT? BIND servers are patched frequently Patches are mostly for vulnerabilities Under load, firewalls become bottlenecks Legitimate Clients Load Balanced Servers Access Network Malicious Actors Traditional Firewall Local Load Balancing F5 Networks, Inc 6

7 Number of updates issued True costs BIND HISTORY HIGHER OPEX DUE TO MAINTENANCE BIND by the numbers 340 updates since issued patches for vulnerabilities and bugs 9 patches a year for BIND Version COMPANIES DEPLOY FIREWALLS TO PROTECT But traditional firewalls don t process, so a vulnerability can still be exploited on the server F5 Authoritative Model Traditional Authoritative Topology Critical patches for vulnerabilities Total updates, including beta, release candidates Total in year 1: $301,280 Total in year 2 onward: $1,280 Total in year 1: $373,688 Total in year 2 onward: $298,688 F5 Networks, Inc 7

8 deployments Internet Conventional Thinking External Firewall Load Balancing Array of Servers Internal Firewall Hidden Master Performance = Add boxes Weak DoS/DDoS protection Firewall is THE bottleneck DMZ Datacenter F5 PARADIGM SHIFT Internet F5 Delivery Reimagined BIG-IP Global Traffic Manager Master Infrastructure Firewall DDoS Protection Protocol Validation Authoritative Caching Resolver Transparent Caching High Performance SEC SEC Validation Intelligent GSLB Massive performance over 10M RPS! Best DoS/DDoS protection Lower CapEx and OpEx F5 Networks, Inc 8

9 Optimized Offload to the edge Tier 1: DMZ Tier 2: Application Delivery Legitimate Visitors Legitimate Queries SEC IP geolocation DDoS protection TCP/UDP Port 53 Primary Malicious Attackers Attacks L Internet Intelligent and Scalable Services TCP Port 80/443 Application health Context based on geographical location Threat Intelligence Application IP Intelligence Web Bot Attacker Strategic Point of Control Manageable and predictable data center utilization Easy integration into existing infrastructure for high availability and security Support over 10 million responses per second (RPS) F5 Networks, Inc 9

10 Benefits of BIG-IP integration Simply and efficiently manage complex networks using one ADC solution Route users to available apps and data centers based on business logic Constantly monitor health between devices with iquery Use the same geolocation data to reference for all BIG-IP devices Tier 1: DMZ Tier 2: Application Delivery Legitimate Visitors Authoritative + Security G GTM T M Primary Server + Application Availability and Health LTM Malicious Attackers Context based on geographical location L Internet BIG-IP Platform Absorb and mitigate attacks BIG-IP Platform Intelligent delivery based on business logic BIG-IP Global Traffic Manager BIG-IP Local Traffic Manager Simplified Business Models GOOD BETTER BEST Same purpose-built hardware and software designed for performance Same icontrol for extending management control Same centralized management solution F5 Networks, Inc 10

11 Efficient Express Delivers high-speed response and DDoS protection with in-memory Provides authoritative serving out of RAM Supports configuration size for tens of millions of records Scale and consolidate servers Server Clients Express in BIG-IP GTM Answer Query Manage Records Answer Query Answer Query OS Admin Auth Roles Internet Answer Query Answer Query NIC Dynamic DHCP F5 Networks, Inc 11

12 Powerful Your revenue and your brand are protected Use the same IP address for multiple devices Geographically separate the request load for all requests Scale infrastructure up and out per number of BIG-IP devices F5 Networks, Inc 12

13 Complete Firewall Solution Clients DMZ Data Center Servers L Internet Firewall in BIG-IP GTM Apps F5 FIREWALL SERVICES Protocol inspection and validation record type ACL load balancing High-performance cache Higher-performance slave Stateful never accepts unsolicited responses ICSA Certified DMZ deployment scale across devices IP Anycast Secure responses SEC Complete control irules DDoS threshold alerting logging and reporting Hardened F5 code NOT BIND F5 Networks, Inc 13

14 Total Control with irules Inspect and control traffic Protect and deliver high performance Services with irules Custom Query logging filtering Rate limiting Query/Zone specific LB Honeypot Responses Client Side Last Action X GTM Build SEC Answer _REQUEST Egress GTM Rewrite _RESPONSE SEC Sign irule example: Blackhole* Intercept requests for prohibited FQDNs, return a response with an A record to an LTM virtual server, log the request and serve a static page. Ingress F5 Networks, Inc 14

15 Complete SEC Security Data Center Internet Site Internet. A high-performance SEC validation solution is going to be extremely important as more and more sites deploy SEC. Cricket Liu, VP of Architecture at Infoblox F5 Networks, Inc 15

16 Secure Query Response DMZ Data Center example.com Public Key L example.com Public Key Servers Apps Simple SEC: Protection from cache poisoning and reduce management costs Ensure trusted queries with dynamically signed responses Implement BIG-IP GTM in front of existing servers Available as add-on SEC module or included with all new GTM appliances F5 Networks, Inc 16

17 Slow Response on SEC validation Validating secure site responses require lots of steps that slows response times For example: 15 steps!! F5 Networks, Inc 17

18 Delivery of Resolver L Services Caching / Resolver / SEC Validation High Performance L multicore Filtering and Control irules Seamless integration of internal GSLB services Lower TCO and consolidation query per dollar Internet Site Datacenter Internet F5 Networks, Inc 18

19 Optimize Resolving with Cache Zone Forwarding Faster Web Browsing Caching passes queries to the Resolver when response isn t cached Resolver uses root hints to kick off process Fastest Web browsing Requests for specific zones sent to specific recursive name server Zone not listed, then Resolver follows root hints Request: Zone A Cache Resolver Request: Zone B Not cached Zone B NS Request: Zone C BIG-IP Zone C Forward NS Zone B Forward NS Zone C NS Root Hints (all other zones) F5 Networks, Inc 19

20 SEC irules 64 IPv4 / IPv6 TCP / UDP GTM irules SEC GTM - irules 64 Express Cache 64 Protocol Validation Last Act Resolver LB Pool BIND Zone Management F5 Delivery Architecture filtering/ customization Scale and High Performance Responding to queries with TMM is 2x more efficient than load balancing TMM Linux Dynamic Routing irules TMSH GUI icontrol API Packet Pre-filter inspection Switch HSB Crypto FIPS High Performance Hardware Protocol Filter filtering/ customization F5 Networks, Inc 20

21 Intelligent scale solution diagram Intelligence Scale Device Customer Scenarios Centralized Management Applications Optimized Experience Intelligent & Scalable Services Intelligent Scale Location Authoritative IP Geolocation Core Functionality Real-Time IP Threat Information Network Firewall Attack Mitigation Infrastructure SaaS Professional Services and Support Protect and scale your infrastructure while maintaining availability for applications. F5 Networks, Inc 21

22 Scale, Security for Global App Management with BIG-IP Global Traffic Manager (GTM) OPTIMIZED APPLICATIONS & DATA Dynamic Datacenter Global Load Balancing and App Health Monitoring Geolocation routing Automatic site-to-site failover IPv6/IPv4 Translation Scalability up to 10x Caching and Resolving DMZ BIG-IP Global Traffic Manager Internet DMZ BIG-IP Global Traffic Manager SECURE APPLICATIONS & DATA Transaction Assurance irules Real-time SEC signing SEC Validation DDoS Mitigation Firewall Services BIG-IP Local Traffic Manager App Svr. Active Active BIG-IP Local Traffic Manager App Svr. F5 Networks, Inc 22

23