ADC01060 - Application Control

ADC01060 - Application Control

Introducing Application Control

Persistence
• Load balancing module chooses the best suitable Real
Server
• Populates the persistence table
– Source information Tommy | APP1

– Selected Real Server

Service
Requests APP1
Load Balance

1
Persistence

2
3

APP2
ADC

Content Routing
• Rules control how traffic is forwarded to the backend
servers
• Traffic is classified based on HTTP request content

John
Web Server
Service
(Mobile Web App)

Content Rule

Tommy Web Server

ADC (Desktop Web App)

1
ADC01060 - Application Control

Extended Match Rules

• Specifically define which requests/responses need the rule
applied
• Conditions can be based on found parameters or elements
• Used across multiple modules (not only allow/deny rules)

Request
USER-Agent co Firefox/16

URL Allow/Deny Rule

Response
Tommy Application Server
Firefox 16 301 - Update_your_browser.html

ADC

Rule Evaluation Order

• The policies of the “best matching” rule are applied
• Hierarchical match
– Compares the host header. If there is no match, compares the URL path.
– If multiple ACLs match, each extended match rule is evaluated in
ascending order of extended match sequence
• Sequential match
– Ignores the host header and URL path
– Each extended match rule is evaluated in sequential order based on the
extended match sequence

Rule Evaluation Order

1 2 3
Extended
Host URL Sequence
Match
num.
www.cudau.org /cgi-bin/index.cgi
www.cudau.org /payments/* 1 User-Agent co MSIE 6.0

www.cudau.org /payments/* 2 User-Agent co Mobile

www.bigfishinc.org /payments/*

www.cudau.org /*

www.bigfishinc.org /*

2
ADC01060 - Application Control

Rule Evaluation Order

Request: https://www.cudau.org/cgi-bin/index.cgi

Extended
Host URL Sequence
Match
num.
www.cudau.org /cgi-bin/index.cgi
www.cudau.org /payments/* 1 User-Agent co MSIE 6.0

www.cudau.org /payments/* 2 User-Agent co Mobile

www.bigfishinc.org /payments/*

www.cudau.org /*

www.bigfishinc.org /*

Rule Evaluation Order

Request: https://www.bigfishinc.org/index.php

Extended
Host URL Sequence
Match
num.
www.cudau.org /cgi-bin/index.cgi
www.cudau.org /payments/* 1 User-Agent co MSIE 6.0

www.cudau.org /payments/* 2 User-Agent co Mobile

www.bigfishinc.org /payments/*

www.cudau.org /*

www.bigfishinc.org /*

Rule Evaluation Order

Request: https://www.cudau.org/payments/pay.php (from an iPhone)

Extended
Host URL Sequence
Match
num.
www.cudau.org /cgi-bin/index.cgi
www.cudau.org /payments/* 1 User-Agent co MSIE 6.0

www.cudau.org /payments/* 2 User-Agent co Mobile

www.bigfishinc.org /payments/*

www.cudau.org /*

www.bigfishinc.org /*

10

3
ADC01060 - Application Control

Web Translations
• Redirect rules
– Redirect matched traffic to a different web page (no security validations)
• URL translations
– Modifies internal URL components to an externally viewable URL
• HTTP request/response rewrite
– Can be used to relay the client IP address to the backend server
• Response body rewrite
– Searches and replaces any text string in the response body

11

Access Control Overview

• The Load Balancer ADC can authenticate users using
external authentication services
– Authentication can be implemented only for HTTP or HTTPS service
• A validated user has access depending on authorization
privileges

Authorization

Username: tommy
Service Web Server
Password: ********

Tommy Submit Authentication

login_page.html Authentication Server
ADC

12

Trusted Hosts
• Hosts whose traffic is assumed to be safe
– Defined by IP address / network
– Configured in groups
• Use cases
– Exempt specific traffic authentication

13

4
ADC01060 - Application Control

Thank You

14