Forum Discussion

GVIJ_208206's avatar
GVIJ_208206
Icon for Nimbostratus rankNimbostratus
Jun 25, 2015

Reverse Proxy Functionality when WSS is used

Hi,

 

As a part of our solutions proposal we are including F5 to be placed in the DMZ to act as a reverse proxy for the server residing in the customers internal network. Our server application Implementation includes HTTPS and WSS between client and the server. Here is the setup

 

Client-->External Firewall-->F5 Reverse Proxy-->Internal Firewall-->Server

 

Now, the customer has raised the concern that since WSS is being leveraged, F5 can only act as a LTM and not APM and would not provide a true reverse proxy functionality. This could exposes risk to the server application located inside the internal network to attacks.The LTM does not also provide true termination of the incoming HTTP requests.

 

Can you please let me know if leveraging WSS will enable F5 to be just a load balancer and does not provide true reverse proxy functionality?

 

Wouldn't F5 be able to terminate HTTP traffic and act as proxy on behalf of the client in our scenario?

 

Do you see any security risks with this option?

 

thanks

 

APM
application delivery
cisco
design
LTM
security

7 Replies

Sort By
  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Jun 26, 2015
    WSS? West Side Story? Windows Storage Server? Windows SharePoint Services? Why So Serious? WS-Security?
  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Jun 29, 2015

    i don't believe that APM (authentication) was ever a requirement for using the BIG-IP (or any system) as a reverse proxy. in principle a reverse proxy is nothing more then a device which request information from servers and services it to clients.

     

    based on that i don't see why websockets are any different then other other tcp protocol.

     

    in this sol it is stated you can even load balance it fine, showing the separation still exists: http://support.f5.com/kb/en-us/solutions/public/14000/700/sol14754.html

     

  • GVIJ_208206's avatar
    GVIJ_208206
    Icon for Nimbostratus rankNimbostratus
    Jul 15, 2015

    Followup question.

     

    Since F5 would be placed in the customers DMZ network and acting as a proxy (HTTPS/WebSocket) between the Internet client and the Internal application server, are there any major security risks associated with WebSocket connection between Client and the Server?

     

    The Internal application is built on JDK and if exploited via WebSocket connection, could allow the hacker to access the program flow and modify the code. This is the customer concern.

     

    If there is any best practice documentation for F5 configuration to protect against this kind of WebSocket vulnerability, please let me know

     

    Thank you

     

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Jul 15, 2015

    explain me the difference between this and users being able to influence the program flow and modify the code via "normal" HTTP POST and GET commands.

     

    there isn't a difference between normal HTTP and WebSockets if you just use the BIG-IP as proxy. in both cases if you allow the users to send requests and handle those badly things can happen that you don't want. but that is how this works.

     

  • GVIJ_208206's avatar
    GVIJ_208206
    Icon for Nimbostratus rankNimbostratus
    Jul 17, 2015

    Is it correct to say that the BIG-IP provides the same level of security for WSS protocol similar to HTTP?

     

    Are there any server side(Intranet)security features which needs to be Implemented specifically for WSS?

     

    thanks

     

  • GVIJ_208206's avatar
    GVIJ_208206
    Icon for Nimbostratus rankNimbostratus
    Jul 28, 2015

    Hi,

     

    Could you please make refer to my question above? Would need to know if there is any additional security measures needed on our application server residing on the corporate Intranet since WSS would be leveraged via F5.

     

    Thanks