Create an Inbound Gateway Mode Topology ================================================================================ Now that the pre-requisite configuration has been added, you can begin creating your first SSL Orchestrator **Topology**. | Create Topology -------------------------------------------------------------------------------- #. Scroll to the bottom of the **Configuration** introduction page and click on the **Next** button to start creating a new Topology. #. Enter ``l3_inbound_gw`` as the topology name. #. Select the **L3 Inbound** topology type. #. Select the **Gateway** mode. .. image:: ./images/ibgw-create-1.png :align: left #. Scroll down to the bottom of the page and click on the **Save & Next** button to proceed to the next step in the configuration workflow. .. image:: ./images/ibgw-create-2.png :align: left | Create SSL Configuration -------------------------------------------------------------------------------- On the **SSL Configurations** page, create the **Client-side SSL** profile for the first application (jsapp1.f5labs.com). #. In the **Name** field, enter ``jsapp1_f5labs_com`` (overwrite the default value). #. In the **SNI Server Name (FQDN)** field, enter ``jsapp1.f5labs.com``. This will be used to match the SNI provided by the client to this profile. #. Since you will be attaching multiple client SSL profiles, you must make one of them the **default** to handle the case when no SNI match is found. Enable the checkbox for **Default SNI**. .. image:: ./images/ibgw-ssl-sni.png :align: left #. In the **Certificate Key Chain** section, click on the **Edit** (pencil) icon. #. In the **Certificate** drop-down list, select **jsapp1.f5labs.com** to replace the default value. #. In the **Key** drop-down list, select **jsapp1.f5labs.com** to replace the default value. #. In the **Chain** drop-down list, select **subrsa.f5labs.com**. .. image:: ./images/ibgw-ssl-client1.png :align: left | #. Click on the **Done** button to apply the config change. .. image:: ./images/ibgw-ssl-client1b.png :align: left .. note:: You will create the **Client-side SSL** profile for the second application (jsapp2.f5labs.com) later. #. Leave the default **Server-side SSL** settings. .. image:: ./images/ibgw-ssl-server1.png :align: left #. Click on the **Save & Next** button to continue. | Create Services -------------------------------------------------------------------------------- Now, you will create two inspection services: **FireEye NX Inline Layer 2** and **F5 Advanced WAF (On-box)**. #. Click on the **Add Service** button to create the first service. .. image:: ./images/ibgw-svc-1.png :align: left #. Double-click on the **FireEye NX Inline Layer 2** service catalog icon to add it. .. image:: ./images/ibgw-svc-1b.png :align: left #. Leave the default **Name** of **FEYE**. #. Click on the **Add** button in the **Network Configuration** section and use the following settings: - Under **From BIGIP VLAN**, click on the **Create New** radio button. - Enter ``FEYE_in`` in the **Name** field. - Select **1.4** from the **Interface** drop-down list. - Leave the **Tag** field empty. - Under **To BIGIP VLAN**, click on the **Create New** radio button. - Enter ``FEYE_out`` in the **Name** field. - Select **1.5** from the **Interface** drop-down list. - Leave the **Tag** field empty. .. image:: ./images/ibgw-svc-2.png :align: left | - Click on the **Done** button to apply the settings. | .. image:: ./images/ibgw-svc-3.png :align: left | #. Leave the default **gateway_icmp** **Device Monitor** selection. #. Select **Enable Port Remap** and set the port to ``8080``. .. image:: ./images/ibgw-svc-4.png :align: left .. image:: ./images/ibgw-svc-4b.png :align: left #. Click on the **Save** button to return to the **Services** list. #. Click on the **Add Service** button to create the second service. #. Click on the **F5** tab to display F5-specific services. #. Double-click on the **F5 Advanced WAF (On-Box)** service catalog icon to add it. .. image:: ./images/ibgw-svc-5.png :align: left #. Leave the default **Name** of **F5_AWAF**. #. From the **Application Security Policy** drop-down list, select the **rating_waf_policy** policy that you created earlier. .. note:: You have the option to create the WAF policy within this workflow. Clicking on **Create New** opens a new browser tab to the WAF configuration menu. To avoid introducing any confusion in the current workflow, you created the WAF policy object prior to starting any SSL Orchestrator configuration. #. Leave the default settings for the **DoS Protection Profile** and **Bot Defense Profile** options. You will not use these in this lab exercise. #. In the **Log Profiles** section, double-click on the **Log all requests** profile to move it to the *Selected* list. .. image:: ./images/ibgw-svc-6.png :align: left #. Click on the **Save** button to return to the **Services List**. You should now see both services. .. image:: ./images/ibgw-svc-10.png :align: left #. Scroll down to the bottom of the page and click on the **Save & Next** button to proceed to the next step in the configuration workflow. | Create Service Chains -------------------------------------------------------------------------------- Create two service chains. The first one will include only the FEYE service. #. From the **Service Chain List**, click on the **Add** button. .. image:: ./images/ibgw-chain-1.png :align: left #. Enter ``service_chain_1`` in the name field. #. Add the **ssloS_FEYE** service to the service chain. .. image:: ./images/ibgw-chain-2.png :align: left #. Click on the **Save** button. Add a second service chain containing the **FEYE** and **F5_AWAF** service. #. From the **Service Chain List**, click on the **Add** button. #. Enter ``service_chain_2`` in the name field. #. Add the **ssloS_FEYE** and the **ssloS_F5 AWAF** services to the service chain. .. image:: ./images/ibgw-chain-3.png :align: left #. Click on the **Save** button. .. image:: ./images/ibgw-chain-4.png :align: left Click on the **Save & Next** button to continue. | Create Security Policy -------------------------------------------------------------------------------- #. Notice that the **Security Policy** contains a default **All Traffic** rule. .. image:: ./images/ibgw-policy-1.png :align: left | Create a new rule for the first application. #. Click on the **Add** button on the right side of the page. #. Enter ``jsapp1`` in the rule Name field. #. Select the **Server Name (TLS ClientHello)** condition. #. Enter ``jsapp1.f5labs.com`` for the SNI value and click on the **+ button** to apply it. .. image:: ./images/ibgw-policy-2a.png :align: left #. Set **SSL Proxy Action** to **Intercept**. #. Set **Service Chain** to **ssloSC_service_chain_1**. .. image:: ./images/ibgw-policy-2b.png :align: left #. Click on the **OK** button to save the new rule. | Another rule will be needed for the second application. #. Click on the **Add** button on the right side of the page. #. Enter ``jsapp2`` in the rule Name field. #. Select the **Server Name (TLS ClientHello)** condition. #. Enter ``jsapp2.f5labs.com`` for the SNI value and click on the **+ button** to to apply it. #. Set **SSL Proxy Action** to **Intercept**. #. Set **Service Chain** to **ssloSC_service_chain_2** (ensure that you select the second service chain). .. image:: ./images/ibgw-policy-3.png :align: left #. Click on the **OK** button to save the new rule. | Now, edit the default rule. #. Click on the **Edit** (pencil) icon for the **All Traffic** rule. #. Set **Service Chain** to **ssloSC_service_chain_2**. .. image:: ./images/ibgw-policy-4.png :align: left #. Click on the **OK** button. Your **Security Policy** rules should now look like the following: .. image:: ./images/ibgw-policy-5.png :align: left #. Click on the **Save & Next** button to continue. | Create Interception Rule -------------------------------------------------------------------------------- The **Interception Rule** determines what traffic to process. Since there might be a need for an L3 Outbound topology (as the outbound default route), you will define the inbound listener to match the application subnet (192.168.100.0/24). #. Enter ``192.168.100.0%0/24`` in the **Destination Address/mask** field. #. Leave the default value (0) in the **Port** field. .. image:: ./images/ibgw-int-1.png :align: left #. In the **Ingress Network** section, select the **client-vlan** VLAN. .. image:: ./images/ibgw-int-2.png :align: left #. In the **Protocol Settings** section, you should see that the **jsapp1_f5labs_com** SSL configuration is already selected. .. image:: ./images/ibgw-int-3.png :align: left .. note:: You will add the second SSL Profile in a later step. #. For the **L7 Profile**, select **/Common/http**. .. image:: ./images/ibgw-int-4.png :align: left Click on the **Save & Next** button to continue. | Create Egress Settings -------------------------------------------------------------------------------- You will use SNAT all egress traffic and use the default route as a gateway. #. In the **Manage SNAT Settings** drop-down list, select **Auto Map**. #. Leave the default **Gateways** setting. .. image:: ./images/ibgw-egress-1.png :align: left #. Click on the **Save & Next** button to continue. | Create Log Settings -------------------------------------------------------------------------------- #. Leave the default log settings. .. image:: ./images/ibgw-log.png :align: left #. Click on the **Save & Next** button to continue. | Deploy Topology -------------------------------------------------------------------------------- #. Click on the **Deploy** button to create the new topology configuration. .. image:: ./images/ibgw-deploy-1.png :align: left #. When the deployment has completed, click on the **OK** button to continue. You should see the new Topology in the **Topologies** tab. .. image:: ./images/ibgw-deploy-2.png :align: left | Create SSL Configuration for Second Application -------------------------------------------------------------------------------- The guided workflow only allows you to create one **SSL Configuration**, so you will now need to create one for the second application (jsapp2.f5labs.com) and add it to the **Interception Rules**. #. Click on the **SSL Configurations** tab. #. Click on the **Add** button. #. In the **Name** field, enter ``jsapp2_f5labs_com``. #. Disable (uncheck) the setting for **SSL Forward Proxy** (it is enabled by default). .. warning:: If the **SSL Forward Proxy** option is enabled when you deploy this SSL profile, you will have to delete and re-build it. You cannot change this setting after it has been deployed. #. In the **SNI Server Name (FQDN)** field, enter ``jsapp2.f5labs.com``. This will be used to match the SSL profile to the SNI value sent by the client. #. Since you enabled the **Default SNI** setting in the **SSL Configuration** for the first application (jsapp1.f5labs.com), **DO NOT ENABLE** it here. | .. image:: ./images/ibgw-ssl-client2-1.png :align: left #. In the **Certificate Key Chain** section, click on the **Edit** (pencil) icon. #. In the **Certificate** drop-down list, select **jsapp2.f5labs.com** to replace the default value. #. In the **Key** drop-down list, select **jsapp2.f5labs.com** to replace the default value. #. In the **Chain** drop-down list, select **subrsa.f5labs.com**. .. image:: ./images/ibgw-ssl-client2-2.png :align: left | #. Click on the **Done** button to apply the config change. #. Leave the default **Server-side SSL** settings. .. image:: ./images/ibgw-ssl-client2-3.png :align: left #. Click on the **Save & Next** button to continue. #. Click on the **Deploy** button to finish creating the new SSL profile. .. image:: ./images/ibgw-ssl-client2-4.png :align: left #. When the deployment has completed, click on the **OK** button to close the dialog box and return to the **Topologies** list. #. Click on the **SSL Configurations** tab to return to the SSL profiles list. .. image:: ./images/ibgw-ssl-client2-5.png :align: left | Update the Interception Rule -------------------------------------------------------------------------------- Now, you need to add the second **SSL Configuration** to the **Interception Rule**. #. Click on the **Interception Rules** tab. .. image:: ./images/ibgw-int-a.png :align: left #. Click on **sslo_l3_inbound_gw** and then click on the **Edit** (pencil) icon to edit the settings. .. image:: ./images/ibgw-int-b.png :align: left #. Scroll down to the **Protocol Settings** section and add the **jsapp2** **Client SSL** and corresponding **jsapp2** **Server SSL** profiles to the **Selected** list. .. image:: ./images/ibgw-int-c.png :align: left #. Click on the **Save & Next** button to return to the **Interception Rules Summary**. #. Click on the **Deploy** button. #. When the deployment has completed, click on the **OK** button to close the dialog box and return to the **Topologies** list. This completes the Topology configuration.