NetScaler 培训PPT

1、Citrix NetScaler Application Firewall 培训,Agenda,Citrix WAF简述 顺网拓扑架构简介 业务上线流程 Application Firewall 技术概述,2,网页应用程序防火墙,Network Firewall,IDS IPS,Database Servers Customer Info Business Data Transaction Info,私密资料,客制化网页程序 客制化套装应用程序 自行开发或第三方程式,特征码,HTTP/HTTPS,我看得懂 文档,WAF,我看不懂 不让你过,正常访问,我看不懂 放行,依据网页程序内容逻辑， 制定

2、合法规则，检测进出联机内容,3,正向防护白名单,预设行为：阻挡 符合规则：放行 效益： 防范已知/未知攻击 防护产品： 网络防火墙 网页应用程序防火墙 其他： 不易误判(除非设定错误) 需时间学习/设定,反向防护黑名单,预设行为：放行 符合特征：阻挡 效益： 防范已知攻击 防护产品： 防病毒软件/防毒墙 入侵侦没系统(IPS) 其他： 容易误判 容易绕过,防护逻辑,4,2020/7/29,WAF vs IPS vs Network Firewall,5,WAF运作机制 双向保护,用户请求,服务器回应,Internet/Intranet,WAF,请求检查,输入正确性 检测,安全转发,Protec

3、ted AP,用户请求,安全转发,服务器回应,内容响应 防护处理,NetScaler网页应用防火墙采用混合安全模型,正面表列 自我学习应用程序,负面表列 特征码侦测,Negative,Positive,Hybrid,混合模型 防护已知和未知的安全威胁,7,DDos,SSL/VPN,SSL,WAF,XML FW,AAA,SSO,Reporting,NetScaler MPX and VPX,Citrix NetScaler融合多种应用安全,Internet,Web App Users,允许合法流量通过 响应内容检测,应用程序攻击阻挡,防御Zero day攻击 双向检测：进阶式攻击防御 SSL 加

4、密联机支持 ICSA, Common Criteria认证,8,Agenda,Citrix WAF简述 顺网拓扑架构及Netscaler架构概述 业务上线流程 Application Firewall 技术概述,9,现网拓扑,10,NetScaler Architecture Overview,NetScaler-owned IP Addresses,The NetScaler system uses different types of IP addresses for management and proxying connections to the server These IP ad

5、dresses are: NetScaler IP (NSIP) addresses Subnet IP (SNIP) addresses Virtual IP (VIP) addresses,NetScaler IP Address,The NetScaler IP address (NSIP) is the primary address for management and general system access The default IP address and netmask is /16 () 修改该IP地址，设备需要重启,Su

6、bnet IP Address,The subnet IP (SNIP) address is used in connection management and server monitoring A SNIP address provides the NetScaler system with an Address Resolution Protocol (ARP) presence in subnets to which the system may not be directly connected A NetScaler system should have a SNIP addre

7、ss configured for every directly connected subnet,Virtual IP Address,VIP addresses are used for client-to-NetScaler-system communication When the VIP address is a public IP address, it usually corresponds to the DNS entry for a domain A VIP address is automatically created when a virtual server is a

8、dded,Entity Management,High Availability Functionality,上线后全网配置调整,NS上对外发布一个VIP，F5的VIP作为NS VIP的Service.防火墙将原先的到F5 VS的映射改为到NS VS的映射。 由于服务器端需要看到客户端的真实IP地址，现在的架构是在F5上通过插入一个HTTP X-Forwarded-For报头（报头里面记录了客户端IP地址），服务器端解这个报头来获得客户端真实IP。 NS部署后，添加这个报头的工作由NS完成，即将F5上配置的这个功能取消，将这个功能在NS上配置，在NS上配置的报头名称不变，这样后台服务器就不需要

9、做任何修改。,18,Hardware Components,Hardware components of the NetScaler system include: Network interfaces LCD Serial interface File system RAM drive(/) Flash memory (/flash) Hard disk (/var),Hardware Components,NetScaler Architecture Overview,Agenda,Citrix WAF简述 顺网拓扑架构及Netscaler架构概述 业务上线流程 Application F

10、irewall 技术概述,22,操作流程,通过GUI方式登录设备进行配置（客户端需要JRE环境） NSIP/SNIP 都可以对设备进行配置管理 通过SSH登录设备进行命令行下查看配置等操作,23,上线流程,创建Service（F5 VS地址） 创建对外发布的VS地址并关联相应Service 创建WAF Policy 将WAF Policy与相对应的VS关联,24,Agenda,Citrix WAF简述 顺网拓扑架构及Netscaler架构概述 业务上线流程 Application Firewall 技术概述,25,WAF技术介绍,INTERNAL,Data Flow Process,NetSc

11、aler,Web Applications,Database,1. Client Request ,EXTERNAL,2. Request Inspections,3. Client Request ,4. Server Response ,5. Response Inspections,6. Server Response ,Start URLs XSS SQL Injection Field Consistency Buffer Overflow,Credit Cards SAFE Object,Full ADC Integration,Profiles Enable Basic or A

12、dvanced defaults Consists of Security Settings Policies Directs traffic to profiles Matches on request or response parameters Policy创建后，即可以设置为全局生效，即所以流量都通过该policy进行检查；或者关联到一个VS上单独生效,Customizable Profiles and Policy,Complete Web App Protection with Learning,Positive Security,Application Firewall Adva

13、nced profile,When configure application firewall (appfw), 1st thing to do is create a profile. And there is Basic and Advanced profile, what is the difference? With advanced profile, “sessionization” or session tracking will be enabled. The security checks required sessionization are: URL Closure Co

14、okie Consistency Form Field Consistency,Application Firewall sessionization,What is sessionization? It means Appfw has to track all requests and responses from a client as long as the browser remains open within the session timeout period (that is track each session) The session is marked by session

15、 cookie, the default cookie name is citrix_ns_id Default session timeout is 900 seconds (15 minutes),AppFw why sessionization is needed?,Example 1 buffer overflow protection,As an example, assume the Appfw is configured with buffer overflow such that maximum allowed URL length is 10 characters,Appfw

16、 does not need to care who sends the request, as long as the URL is longer than 10 characters, it will block it,AppFw why sessionization is needed?,Example 2 URL Closure,As an example, assume the Appfw is configured with startURL and URL Closure protection, the startURL allowed is home1.htm,User A,I

17、n this example, we can observe that feature like URL Closure required the Appfw to “record” some sort of activities for each user/session in order to determine to allow or block the request. In the other words, the sessions history is a factor to determine allow/block,Appfw - sessionization,We have

18、to pay the price for sessionization that is Memory. Since we need to store information for each session, more memory is required There is something interesting here, except from the number of user, there are some other factors that affect how much memory is required,Appfw URL Closure example,Web pag

19、e 1,Web page 2,For URL Closure, which of the above page will consume more memory when a user access the page as startURL?,Appfw Memory usage,Of course “web page 2” will takes more memory because it has much more hyperlink, when appfw stores information on which link the user can access, it needs to

20、store more information URL Closure: More hyperlink more memory is required Form Field Consistency: More form/larger form more memory is required (Usually most memory consuming is URL Closure because web page with a lot of links are common but web page with a lot of forms is less common),Easy Deploym

21、ent Mode Protects against SQL Injection Cross Site Scripting Cross site Request Forgery (Referrer header) Forceful Browsing (Start/Deny URLs) Buffer Overflow Form Field Formatting No sessionization required Learning aided deployment,Basic Defaults Positive Security Model,SQL Injection attacks,How th

22、is might be done: User enters data into a form on a web page The application sends this as part of an SQL query to the back end database,Item Number:,Item Lookup,Enter Desired Item Number,SUBMIT,1234 or 1=1,Cross-site Scripting (XSS) Attacks,Attacking trust relationships,Cross Site Request Forgery A

23、ttacks,Protection actions Verify Referrer headers Tag each form with unique token and verify on form submission. .,Attacking trust relationships,CSRF: Referrer Header Protection, . , Cookie: auth=good Referer: ,X,Forceful Browsing,Forceful Browsing Attack Manipulating request URLs to gain access to

24、content you are not entitled to see.,Brute-force penetration of the infrastructure,Paris Hiltons Sidekick hacked hacker Nicolas Jacobsen pled guilty to a single charge of intentionally accessing a protected computer and recklessly causing damage. Jacobsen was arrested by US authorities last October,

25、 but had had access to T-Mobiles servers for more than a year. He reportedly amused himself by accessing US Secret Service email, and raiding other Sidekick users accounts.,I got hacked,Buffer Overflow Protection,Hacker,Buffer Overflow Attack,Application,Platform,OS,Gain application Privileges,Gain

26、platform privileges,Gain root server access,Prevent hackers from gaining unauthorized system privileges,Application Firewall limits input parameter sizes for:,URLs Headers Cookies,Application Server,Internet,Advanced Defaults Session based enables additional protections Cookie Form Field Consistency

27、 URL Closure protection Tag Based Cross Site Request Forgery Includes all basic protections,Session-based Protection with Advanced Defaults,Cookie Poisoning defense: Prevents identity theft and session hijacking,Client returns cookie to server,Web server sends client cookie,Application Firewall veri

28、fies that cookies have not been modified by client,Cookie Attack Protection Encrypt Cookies,Encrypt only session cookies (non-persistent) or all application cookies. AES-192 encryption.,Cookie Attack Protection Proxy Cookies,Replace all server cookies with a single App Firewall session cookie,Cookie

29、 Attack Protection Flag Cookies,HTTP Only Make cookie unavailable to JavaScript Secure Cookie submitted only for HTTPS URLs All Both attributes are added to the Set-Cookie header,CSRF: Form Tagging Protection, . , Cookie: auth=good,X,HTML Form Field Protection,Client completes and returns form,Appli

30、cation sends form to client,Protect applications by blocking malicious and illegal input parameters,For each user session AppFw ensures that: Each field is returned No fields were added by client Read-only and hidden fields are unaltered Data in drop-down list or radio button field conforms Max leng

31、th of form fields is adhered to,Additional Security Measures,Click to Rule Application Firewall,Application Firewall relaxation rules can now be deployed from the logs The logs must be in CEF log format Convenient option to relax a rule blocking a legitimate request,Citrix Confidential - Do Not Dist

32、ribute,Log using CEF-based logs Mar 15 16:48:14 50 CEF:0|Citrix|NetScaler|NS10.0|APPFW|APPFW_STARTURL|6|src=9 spt=52737 method=GET request=52/ msg=Disallow Illegal URL. cn1=69 cn2=3999 cs1=Application_Firewall_Profile cs2=PPE2 cs3=edw9DRH/XRTNya64AIYNZM1sgfUA020

33、 cs4=ALERT cs5=2012 act=blocked Easy integration with numerous vendors that support CEF format,Common Event Format Logging Support,Business Object Protection Modules,Financial Theft Prevention,Prevent the inadvertent disclosure of customer or corporate data,Configurable Protections,Credit Card Numbe

34、rs,Customer-defined Data Objects,Mastercard 5168701720999598 5487106695039822 5374247346295037 5229226821960783 5120772245608565 5418244166026814 5214846392378060 5593219822414122 5302495774841718 5141463445796112 VISA 4532804852500010 4328380488186126 4532740912246923 4716318594729561 4916022347049

35、263 4929693453925879 4916392627322353 4485495924283904 4532203936162055 4916164014266109,Mastercard XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX VISA XXXXXXXXXXXXXXXX XXXXXXXX

36、XXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX,Server: Msg 547, Level 16, State 1, Procedure error_demo_sp, Line 2 UPDATE statement conflicted with COLUMN FOREIGN KEY constraint fk7_acc_cur. The conflict occurred in database bos_sommar, table currencies, column curcode. The statement has been terminated.,57,Signatures