Integrating SSL Orchestrator with McAfee Web Gateway-Transparent Proxy

Introduction

SSL Orchestrator centralizes & manages decryption of SSL/TLS traffic. This enables security and monitoring tools to view the decrypted content and analyze it for threats and other anomalies. SSL Orchestrator removes the burden of decrypting content from your security tools so they perform better and are more scalable.

An integrated F5 and McAfee Web Gateway solution eliminates the blind spots introduced by SSL/TLS encrypted content.

Versions Tested

This article assumes you have SSL Orchestrator configured with a Topology and Service Chain

F5 BIG-IP version 17.1
SSL Orchestrator version 11.0
McAfee Web Gateway version 11.2
McAfee Web Gateway will be configured as a Transparent Proxy

Additional Help

If setting up SSL Orchestrator for the first time refer to the F5 SSL Orchestrator Deployment Guides
For information on SSL Certificate considerations and trust, refer to Implementing SSL Orchestrator - Certificate Consid... - DevCentral

McAfee Web Gateway (MWG) Configuration

Configure the Transparent Web Proxy as follows and click the plus sign under Port Redirects

Set the Destination proxy port to 80 and click OK

Click Save Changes

Configure the Network Interfaces as follows

Specify the IP address and mask to be used for eth2, 10.0.0.55 255.255.255.0 in this example.

Specify the IP address and mask to be used for eth3, 10.1.1.5 255.255.255.0 in this example.
The Default Gateway will be a Self IP address on SSL Orchestrator, 10.1.1.1 in this example.

BIG-IP SSL Orchestrator Configuration

The BIG-IP VLAN settings should look like the following

10.0.0.0 is the interface used for Transparent Proxy connections to the MWG
10.1.1.0 is the interface used for Transparent Proxy connections to SSL Orchestrator
North_vlan is used for network connectivity from the BIG-IP to the North
South_vlan is used for network connectivity from the BIG-IP to the South

The BIG-IP Self IPs setting should look like the following

10.0.0.1 will be used for Transparent Proxy connections to the McAfee Web Gateway
10.1.1.1 will be used for Transparent Proxy connections from the McAfee Web Gateway

Note: in this example SSL Orchestrator is deployed with an L3 Outbound Topology. That’s what the other two Self IPs are for. Your configuration will look different if using an L2 Topology.

This article assumes you have SSL Orchestrator configured with a Topology and Service Chain.

Navigate to SSL Orchestrator > Configuration

Create the McAfee Web Gateway Service

Under Services, click Add.

In the Service Catalog select the Inline HTTP tab then double click on McAfee Web Gateway HTTP Proxy.

Give it a name, MWG in this example.
Under Service Definition unselect the option to Auto Manage Addresses.

Set the Proxy Type to Transparent

For the To Service VLAN select 10.0.0.1 (VLAN 10.0.0.0).
Click Add for HTTP Proxy Devices.

Enter the MWG IP address, 10.0.0.55 in this example. Click Done.

For the From Service VLAN select 10.1.1.1 (VLAN 10.1.1.0)

Enable Port Remap. Set the Remap Port to 80.

Set Manage SNAT Settings to Auto Map

Click Save & Next at the bottom.

Click the name of the Service Chain.

Select the MWG Service from the left and click the arrow to move it to the right. Click Save.

Click OK

Click Save & Next at the bottom.

Click Deploy

Click OK to the Success message.

When done it should look like the following:

From the Services screen if you expand the Pool Member Status you should see the McAfee Web Gateway

Testing the Configuration

In this example there is a Windows client that connects through the SSL Orchestrator to a Windows server running the following web site:

https://10.4.11.52

Test this connection now and it should look like the following:

In this example the MWG is configured with a Custom Category to block connections to http://10.4.11.99. When attempting to connect to this site with a web browser you should see a block page like the following:

Conclusion

This completes configuration of BIG-IP SSL Orchestrator with McAfee Web Gateway. At this point traffic that flows through SSL Orchestrator will be decrypted and sent to the MWG Service and inspected for malicious payloads or policy violations.