F5 SSL Orchestrator

SSL Orchestrator provides an all-in-one appliance solution designed specifically to optimize the SSL infrastructure, provide security devices with visibility of SSL/TLS encrypted traffic, and maximize efficient use of that existing security investment. This solution supports policy-based management and steering of traffic flows to existing security devices, designed to easily integrate into existing architectures, and centralizes the SSL decrypt/encrypt function by delivering the latest SSL encryption technologies across the entire security infrastructure.

Multi-Layered Security

In order to solve specific security challenges, security administrators are accustomed to manually chaining together multiple point products, creating a bare-bones “security stack” consisting of multiple services. A typical stack may include components like Data Leak Prevention (DLP) scanners, Web Application Firewalls (WAF), Intrusion Prevention and Detection Systems (IPS and IDS), Malware Analysis tools, and more. In this model, all user sessions are provided the same level of security, as this “daisy chain” of services is hard-wired.

Dynamic Service Chaining

SSL Orchestrator provides the option to bypass or send traffic to a definable chain of inspection devices and to optionally decrypt it or non-decrypt (only for pre-handshake TCP classifier) it before sending. When creating service chain classifier rules, you can select the chain to send it through, as well as defining what type of traffic to send, based on several factors. Afterwards, the user traffic is sent back to the BIG-IP, which re-encrypts the traffic and sends it to the destination. User traffic of certain categories may also be rejected by the BIG-IP or bypass the security inspections. All of these options can be used in either a one or two device deployment.

Classification Engine

Classification Engine provides a rich set of methods based on context to dynamically determine how best to optimize the flow through the security stack. Context can come from the following:

• Source IP/subnet
• Destination IP/subnet
• IP intelligence category - Subscription
• IP geolocation
• Host and domain name
• URL filtering category - Subscription
• Destination port
• Protocol

Deployment Modes

In addition, the system can detect and transparently handle an explicit proxy between Herculon SSL Orchestrator and the internet.

SSL Orchestrator Diagnostic

Diagnostically monitor each device configuration deployment and undeployment, whether you are deploying a single device or multiple devices in a HA device group. An application status message displays above the network diagram indicating whether your device, or device group, successfully deployed or suffered an error. The Diagnostic screen displays the current device's deployment information and assists in further diagnosing any issues.

Import and Export Configuration Settings for Deployment

SSL Orchestrator provides both import and export capabilities so you can deploy previously successful configurations to resolve specific configuration issues or deploy into any SSL Orchestrator environment. When importing past configurations, you can use the roll back capability by selecting a previously saved, or imported, JSON file. You can also export previously successful deployment configurations as JSON files to use in any SSL Orchestrator environment.

Additional resources

You can find additional support resources and technical documentation through a variety of sources.

• The F5 Networks Technical Support web site: https://f5.com/support
• The AskF5 web site: https://support.f5.com/csp/home
• The F5 DevCentral web site: https://devcentral.f5.com/
• AskF5 Publication Preference Center: https://interact.f5.com/AskF5-SubscriptionCenter.html

F5 Networks Technical Support

Free self-service tools give you 24x7 access to a wealth of knowledge and technical support. Whether it is providing quick answers to questions, training your staff, or handling entire implementations from design to deployment, F5 services teams are ready to ensure that you get the most from your F5 technology.

AskF5

AskF5 is your storehouse for thousands of knowledgebase articles that help you manage your F5 products more effectively. Whether you want to browse periodically to research a solution, or you need the most recent news about your F5 products, AskF5 is your source.

F5 DevCentral

The F5 DevCentral community helps you get more from F5 products and technologies. You can connect with user groups, learn about the latest F5 tools, and discuss F5 products and technology.

AskF5 Publication Preference Center

To subscribe, click AskF5 Publication Preference Center, enter your email address, select the publications you want, and click the Submit button. You will receive a confirmation email. You can unsubscribe at any time by clicking the Unsubscribe link at the bottom of the email, or on the AskF5 Publication Preference Center screen.

• TechNews Weekly eNewsletters: Up-to-date information about product and hotfix releases, new and updated articles, and new feature notices.
• TechNews Notifications: Periodic plain text TechNews, sent any time F5 releases a product or hotfix. (This information is always included in the next weekly HTML TechNews email.)
• Security Alerts: Timely security updates and ASM attack signature updates from F5.