logo资料库

netscaler appfirewall 部署手册.pdf

发布时间：2022-06-06 发布人：admin 分类：说明书 资料大小：1.15M 资料格式：pdf 举报 版权申诉
第1页 / 共17页
第2页 / 共17页
第3页 / 共17页
第4页 / 共17页
第5页 / 共17页
第6页 / 共17页
第7页 / 共17页
第8页 / 共17页
资料共17页，剩余部分请下载后查看
    Deploying NetScaler AppFirewall Deployment Guide This deployment guide provides general guidelines for deploying the NetScaler Application Firewall. Deployment Guidecitrix.com
    Table of Contents Introduction AppFirewall Features Rules and Signatures Integrating with other NetScaler features Packet Processing with NetScaler and AppFirewall Standard Workflow for Deploying AppFirewall Deploying the AppFirewall Basic and Advanced Policies Custom Policy Bindings Conclusion 3 3 7 8 8 9 11 12 16 18 2 Deployment Guidecitrix.comDeploying NetScaler AppFirewall
    Citrix NetScaler AppFirewall is a comprehensive ICSA certified web application security solution that blocks known and unknown attacks against web and web services applications. NetScaler AppFirewall enforces a hybrid security model that permits only correct application behaviour and efficiently scans and protects against known application vulnerabilities. It analyzes all bidirectional traffic, including SSL-encrypted communication, to protect against a broad range of security threats without any modification to applications. Introduction NetScaler AppFirewall (also referred to as AppFirewall, Web Application Firewall or WAF) technol- ogy is included in and integrated with Citrix NetScaler MPX and NetScaler VPX , Platinum Edition, and is available as an optional module that can be added to NetScaler MPX appliances running NetScaler Enterprise Edition. NetScaler AppFirewall is also available as a stand-alone solution on some NetScaler MPX appliances. The stand-alone NetScaler AppFirewall models can be upgraded through software licensing to full NetScaler Application Delivery Controllers (ADCs). This guide focuses on defining the general deployment guidelines for Citrix NetScaler AppFirewall. The product versions described here are - Product NetScaler (AppFirewall Integrated Module) Version 10.5 (Enterprise/Platinum License) AppFirewall Features Hybrid security model The NetScaler hybrid security model allows you to take advantage of both a positive security mod- el and a negative security model to come up with a configuration ideally suited for your applications. The positive security model protects against Buffer Overflow, CGI-BIN Parameter Manipulation, Form/Hidden Field Manipulation, Forceful Browsing, Cookie or Session Poisoning, Broken ACLs, Cross-Site Scripting (XSS), Command Injection, SQL Injection, Error Triggering Sensitive Information Leak, Insecure Use of Cryptography, Server Misconfiguration, Back Doors and Debug Options, Rate-Based Policy Enforcement, Well Known Platform Vulnerabilities, Zero-Day Exploits, Cross Site Request Forgery (CSRF), and leakage of Credit Card and other sensitive data. The negative security model uses a rich set signatures to protect against L7 and HTTP application vulnerabilities. The application firewall is integrated with several third party scanning tools, such as those offered by Cenzic, Qualys, Whitehat, and IBM. The built-in XSLT files allow easy importation 3 Deployment Guidecitrix.comDeploying NetScaler AppFirewall
    of rules, which can be used in conjunction with the native-format Snort based rules. An auto- update feature gets the latest updates for new vulnerabilities. The positive security model might be the preferred choice for protecting applications that have a high need for security, because it gives you the option to fully control who can access what data. You allow only what you want and block the rest. This model includes a built-in security check configuration, which is deployable with a few clicks. However, keep in mind that the tighter the security, the greater the processing overhead. The negative security model might be preferable for customized applications. The signatures allow you to combine multiple conditions, and a match and the corresponding action are triggered only when all the conditions are satisfied. You block only what you don’t want and allow the rest. A spe- cific fast-match pattern in a specified location can significantly reduce processing overhead to optimize performance. The option to add your own signature rules, based on the specific security needs of your applications, gives you the flexibility to design your own customized security solutions. Request as well as response side detection and protection You can inspect the incoming requests to detect any suspicious behavior and take appropriate actions, and you can check the responses to detect and protect against leakage of sensitive data. Rich set of built-in protections for HTML, XML and JSON payloads The application firewall offers 19 different security checks. Six of them (such as Start URL and Deny URL) apply to both HTML and XML data. Five checks (such as Field Consistency and Field Format) are specific to HTML, and eight (such as XML Format and Web Service Interoperability) are specific to XML payloads. This feature includes a rich set of actions and options. For example, URL Closure enables you to control and optimize the navigation through your website, to safeguard against forceful browsing without having to configure relaxation rules to allow each and every legitimate URL. You have the option to remove or x-out the sensitive data, such as credit-card numbers, in the response. Be it SOAP array attack protection, XML denial of service (XDoS), WSDL scan prevention, attachment check, or any number of other XML attacks, you have the comfort of knowing that you have an ironclad shield protecting your data when your applications are protected by the applica- tion firewall. The signatures allow you to configure rules using XPATH-Expressions to detect violations in the body as well as the header of a JSON payload. GWT Support for protecting Google Web Toolkit applications to safeguard against SQL, XSS and Form Field Consistency check violations. Java-free, user friendly graphical user interface (GUI) An intuitive GUI and preconfigured security checks make it easy to deploy security by clicking a few buttons. A wizard prompts and guides you to create the required elements, such as profiles, poli- cies, signatures, and bindings. The HTML5 based GUI is free of any Java dependency. It’s performance is significantly better than that of the older, Java based versions. 4 Deployment Guidecitrix.comDeploying NetScaler AppFirewall
    Easy to Use and automatable CLI Most of the configuration options that are available in GUI are also available in the command line interface (CLI). The CLI commands can be executed by a batch file and are easy to automate. Support for REST API The NetScaler NITRO protocol supports a rich set of REST API’s to automate application firewall configuration and collect pertinent statistics for ongoing monitoring of security violations. Learning The application firewall’s ability to learn by monitoring traffic to fine tune security is very user friendly. The learning engine recommends rules, which makes it easy to deploy relaxations without proficiency in regular expressions. RegEx editor support Regular expression offer an elegant solution to the dilemma of wanting to consolidate rules and yet optimize search. You can capitalize on the power of regular expressions to configure URLs, field names, signature patterns, and so on. The rich built-in GUI RegEx editor offers you a quick ref- erence for the expressions and provides a convenient way to validate and test your RegEx for accuracy. Customized error page Blocked requests can be redirected to an error URL. You also have the option to display a custom- ized error object that uses supported variables and Citrix default syntax (advanced PI expressions) to embed troubleshooting information for the client. PCI-DSS, stats, and other violation reports The rich set of reports makes it easy to meet the PCI-DSS compliance requirement, gather stats about traffic counters, and view violation reports for all profiles or just one profile. Logging and click-to-rule from log Detailed logging is supported for native as well as CEF format. The application firewall offers you the ability to filter targeted log messages in the syslog viewer. You can select a log message and deploy a corresponding relaxation rule by a simple click of a button. You have the flexibility to cus- tomize log messages and also have support for generating web logs. For additional details, see http://docs.citrix.com/en-us/netscaler/11/security/application-firewall/logs.html. Include violation logs in trace records The ability to include log messages in the trace records makes it very easy to debug unexpected behavior such as reset and block. Cloning The useful Import/Export profile option allows you to clone the security configuration from one NetScaler appliance to others. Export learned data options make it easy to export the learned rules to an Excel file. You can then get them reviewed and approved by the application owner before applying them. 5 Deployment Guidecitrix.comDeploying NetScaler AppFirewall
    AppExpert Templates An AppExpert template (a set of configuration settings) can be designed to provide appropriate protection for your websites. You can simplify and expedite the process of deploying similar pro- tection on other appliances by exporting these cookie-cutter templates to a template file. For additional details, see http://docs.citrix.com/en-us/netscaler/10-5/ns-appexpert-con-10/ns- aapexpert-apptemp-wrapper-con.html Sessionless security checks Deploying sessionless security checks can help you reduce the memory footprint and expedite the processing. Interoperability with other NetScaler features The application firewall works seamlessly with other NetScaler features, such as rewrite, URL trans- formation, integrated caching, CVPN, and rate limiting. Support of PI expressions in policies You can leverage the power of advanced PI expressions to design policies to implement different levels of security for different parts of your application. Support for IPv6 The application firewall supports both IPv4 and IPv6 protocols. Geolocation based security protection: You have the flexibility of using Citrix default syntax (PI Expressions) for configuring location based policies, which can be used in conjunction with a built-in location database to customize firewall protection. You can identify the locations from which malicious requests originate, and enforce the desired level of security-check inspections for requests that originate from a specific geographical location. Performance Request-side streaming significantly improves performance. As soon as a field is processed, the resulting data is forwarded to the back end while evaluation continues for the remaining fields. The improvement in processing time is especially significant when handling large posts. Other security features The application firewall has several other security knobs that can help ensure the security of your data. For example, the Confidential Field lets you block leakage of sensitive information in the log messages, and Strip HTML Comment allows you to remove the HTML comments from the response before forwarding it to the client. Field Types can be used to specify what inputs are allowed in the forms submitted to your application. 6 Deployment Guidecitrix.comDeploying NetScaler AppFirewall
    Rules and Signatures The application firewall makes it very easy to design the right level of security for your applications. You can have multiple application firewall policies, bound to different application firewall profiles, to implement different levels of security-check inspections for your applications. You can initially monitor the logs to observe what security threats are being detected and which violations are being triggered. Rule creation is made straightforward with the application firewall’s rule engine, which supports two types of rules – learned rules and relaxation rules. You can either manually add relaxation rules or take advantage of the application firewall’s recommended learned rules to deploy the required relaxations to avoid false positives. The Citrix application firewall offers visualizer support in the GUI, which makes rule management very easy. You can easily view all the data on one screen, and take action on several rules with one click. The biggest advantage of the visualizer is that it recommends regular expressions to consoli- date several rules. You can select a subset of the rules, basing your selection on the delimiter and Action URL. Visualizer support is available for viewing 1) learned rules and 2) relaxation rules. 1) The visualizer for learned rules offers the option to edit the rules and deploy them as relaxations. You can also skip (ignore) rules. 2) The visualizer for deployed relaxations offers you the option to add a new rule or edit an existing one. You can also enable or disable a group of rules by selecting a node and clicking the Enable or Disable button in the relaxation visualizer. A signature is an object that can have multiple rules. Each rule consists of one or more patterns that can be associated with a specified set of actions. The application firewall has a built-in default signature object consisting of more than 1,300 signature rules, with an option to get the latest rules by using the auto-update feature to get protection against new vulnerabilities. Rules created by other scan tools can also be imported. Signatures are very powerful because they use pattern matching to detect malicious attacks and can be configured to check both the request and the response of a transaction. They are a pre- ferred option when a customizable security solution is needed. Multiple action choices (for example, block, log, learn, and transform) are available for when a signature match is detected. The default signatures, such as web-cgi, web-coldfusion, web-frontpage, web-iis, web-php, web- client, web-activex, web-shell-shock, and web-struts, cover rules to protect different types of applications. To match the needs of your application, you can select and deploy the rules belong- ing to a specific category. 7 Deployment Guidecitrix.comDeploying NetScaler AppFirewall
    Signature usage tips: • You can just make a copy of the default signature object and modify it to enable the rules you need and configure the actions you want. • The signature object can be customized by adding new rules, which can work in conjunction with other signature rules. • The signature rules can also be configured to work in conjunction with the security checks speci- fied in the application firewall profile. If a match indicating a violation is detected by a signature as well as a security check, the more restrictive action is the one that gets enforced. • A signature rule can have multiple patterns and be configured to flag a violation only when all the patterns are matched, thereby avoiding false positives. • Careful selection of a literal fast-match pattern for a rule can significantly optimize processing time. Integrating with other NetScaler features The application firewall is fully integrated into the NetScaler appliance and works seamlessly with other features. You can configure maximum security for your application by using other NetScaler security features in conjunction with the application firewall. For example, AAA-TM can be used to authenticate the user, check the user’s authorization to access the content, and log the accesses, including invalid login attempts. Rewrite can be used to modify the URL or to add, modify or delete headers, and responder can be used to deliver customized content to different users. You can define the maximum load for your website by using rate limiting to monitor the traffic and throttle the rate if it is too high. HTTP Denial-of-Service (DoS) protection can help distinguish between real HTTP clients and malicious DoS clients. You can narrow the scope of security-check inspection by binding the application firewall policies to virtual servers, while still optimizing the user experience by using the load balancing feature to manage heavily used applications. Requests for static objects such as images or text can bypass security check inspection, taking advantage of integrat- ed caching or compression to optimize the bandwidth usage for such content. Packet Processing with NetScaler and AppFirewall The flow of a packet in the NetScaler appliance is shown in the diagram below. This diagram is also available in the Processing Order of Features section at http://docs.citrix.com/en-us/netscaler/11/ getting-started-with-netscaler.html. 8 Deployment Guidecitrix.comDeploying NetScaler AppFirewall
    分享到：
    赞 收藏

    相关推荐

    资料库

    安全技术

    共收录1285份资料，累计4个分类，关注成员有19位，主要包括：网络攻防,系统安全,其它,网络安全

    热门标签

    网络攻防 系统安全 其它 网络安全

    最新资料