Security is Hard: Part 2 Acme Strikes Back
Situation: Acme Corp is running at Mach 3, preparing to release the latest and greatest widget site of awesomeness.
But, as many have said, talk is cheap! Let’s us be monkeys of action!
Let’s look at a quick method to get this up and running. We are sticking to the KISS method (Keep It Simple Simian), for now anyways.
Make sure the LTM has connectivity with all the resources that are needed. If the vlans are already configured, just run your ping checks (ping each server). If the vlans are not configured, we need to get them setup.
Network –> vLans,
Then we will need to setup the self IP’s for the LTM.
Network –> Self IPs
Build the Pool and virtual server for the application Server.
Keeping it simple, Create dnet4-80 with a HTTP monitor. It goes green, woot!
It listens on port 80, SNATs the traffic automatically, and sends it forward to 126.96.36.199.
Done? eh, Not so fast there mister. How is the application server gathering all it’s pieces? Does it have network access to the file server or the DB server? What if we want a pair of file servers for when things get busy?
This one might be controversial, but it’s my network, so I am going to do it. I set my LTM as the default gateway for the application server. Then, I configure a ip forwarding virtual server, listing on only the application vLan (dnet4). This allows the application server to use the ltm for routing it’s traffic,
So now the LTM can talk to all the pieces, the application can get out to the world to get data, and the virtual server is in place.
Let’s test it:
Well that is one happy monkey! What does it look like in a network diagram?
Is this the end of our merry chase? We could go forth with this, give it to the dev team and say “have fun ya’ll!”. But there is still so much we can do here. What improvements should we make? I know mike called out a couple really good ideas in the previous article. How about ways we increase the resiliency of our application chain, accelerate the application, and add defense to protect our app from attack?
POST YOUR IDEAS! Then, we shall finish this trilogy…. Return of the Security Monkey.