Verified Design: SSL Orchestrator with McAfee Web Gateway-Part 2

Summary

This article is part of a series on implementing Orchestrated Infrastructure Security. It includes High Availability and the protection of critical assets using McAfee Web Gateway. It is assumed that SSL Orchestrator is already deployed, and basic network connectivity is working.

If you need help setting up SSL Orchestrator for the first time, refer to the Dev/Central article series on Implementing SSL Orchestrator here or the CloudDocs Deployment Guide here.

This article focuses on using SSL Orchestrator as a tool to assist with simplifying Change Management processes, procedures and shortening the duration of the entire process.

Configuration files of McAfee Web Gateway can be downloaded from here from GitLab.

Please forgive me for using SSL and TLS interchangeably in this article.

A video demo of this Dev/Central article is available HERE

This article is divided into the following high level sections:

Part1 (Available here)

Configure McAfee Web Gateway (MWG) interfaces
Create a new Topology to perform testing
Monitor McAfee Web Gateway statistics – change the weight ratio – check McAfee Web Gateway stats again
Remove a single McAfee Web Gateway device from the Service

Part 2 (Available here)

Perform maintenance on the McAfee Web Gateway device
Add the McAfee Web Gateway device to the new Topology
Test functionality with a single client
Add the McAfee Web Gateway device back to the original Topology
Test functionality again
Repeat to perform maintenance on the other McAfee Web Gateway device

Perform maintenance on the McAfee Web Gateway device

At this point MWG1 has been removed from the Production_Topology and is no longer handling production traffic. MWG2 is now handling all of the production traffic.

We can now perform a variety of maintenance tasks on MWG1 without disrupting production traffic. When done with the task(s) we can then safely test/verify the health of MWG1 prior to moving it back into production.

Some examples of maintenance tasks:

Perform a software upgrade to a newer version.
Make policy changes and verify they work as expected.
Physically move the device.
Replace a hard drive, fan, and/or power supply.

Add the McAfee Web Gateway device to the new Topology

This will allow us to test its functionality with a single client computer, prior to moving it back to production.

From the SSL Orchestrator Configuration Utility click SSL Orchestrator > Configuration > Topologies > sslo_Topology_Staging.

Click the pencil icon on the right to edit the Service.

Click Add Service.

Select the Generic Inline Layer 2 Service and click Add.

Give it a name or leave the default. Click Add under Network Configuration.

Set the FROM and TO VLANS to the following and click Done.

Click Save at the bottom.

Click the Service Chain icon.

Click the Staging_Chain.

Move the GENERIC Service from Available to Selected and click Save.

Click OK.

Click Deploy.

Click OK.

Test functionality with a single client

We created a policy with source IP = 10.5.9.51 to use the new McAfee Web Gateway Service that we just performed maintenance on.

Go to that client computer and verify that everything is still working as expected.

As you can see this is the test client with IP 10.5.9.51. The page still loads for one of the web servers.

You can view the Certificate and see that it is not the same as the Production Certificate.

Add the McAfee Web Gateway device back to the original Topology

From the SSL Orchestrator GUI select SSL Orchestrator > Configuration > Service Chains.

Select the Staging_Chain.

Select ssloS_GENERIC on the right and click the left arrow to remove Selected.

Click Deploy when done.

Click OK.

Click OK to the Success message.

From the SSL Orchestrator Guided Configuration select SSL Orchestrator > Configuration > Services.

Select the GENERIC Service and click Delete.

Click OK to the Warning.

When that is done click the ssloS_McAfeeWebGateway Service.

Click the Pencil icon to edit the Service.

Under Network Configuration click Add

Set the Ratio to the same value as MWG2, 65535 in this example. Set the From and To VLAN the following and click Done.

Click Save & Next at the bottom.

Click OK.

Click Deploy.

Click OK.

Test functionality again

Check the statistics on the McAfee Web Gateway device again. It’s “MWG1” in this example. From the McAfee Web Gateway UI go to Troubleshooting > Packet tracing. I set the Command line parameters to “-I ibr0” which will capture all packets on the bridge interface.

It should look like the following: