<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html><head></head><body><div style="font-size: 12pt; font-family: Calibri,sans-serif;">You may want to look at Riverbed Stingray as well for this requirements, they are very easy to use and robust. It can run as VM or on top of your server 08/12 as an application firewall. <div><br></div><div>If you need more information let me know happy to help.</div><br><div id="htc_header">----- Reply message -----<br>From: "Tim March" <march.tim@gmail.com><br>To: <ausnog@lists.ausnog.net><br>Subject: [AusNOG] Application Firewall Recommendations<br>Date: Tue, Aug 6, 2013 2:23 PM</div></div><br><pre style="word-wrap: break-word; white-space: pre-wrap;">
+1 for NetScaler WAF.
I've run pretty large mod_security installations and while it's a great
solution it can be a handful to manage at scale. There's a couple of
deployment scenarios;
1. You run it on each of the application servers. This is a handful
because you're making changes in a bunch of places every time you want
to update the ruleset (eg. even if you're pulling the rule
configurations from a single shared location you're still reloading
individual HTTPD's each time you update it).
It also presents ruleset analytics problems if you're not collating all
server logs in one place with something like Splunk (eg. trying to track
down a particular server triggering a particular edge-case rule that's
breaking your app)
2. You run it on a small cluster of reverse proxies with something like
Apache mod_proxy and loop your traffic through that service before it
hits your application servers. This is a good way to collate the service
management down to a small subset of configuration points.
The Citrix NetScaler WAF is a really robust product and probably a
better solution for your situation. It runs on both the physical and MPX
appliances and I'm pretty sure you can spin it up in AWS now as well.
These are much easier to manage and will do everything mod_security will do.
I'm not sure how this ties in with ELB but if there's not already some
Citrix punters on the list drop me a note and I'll put you in touch with
someone there who can help you architect something.
T.
On 6/08/13 1:03 PM, Luke Notley wrote:
> Ed,
> We have moved from TMG/ISA to Citrix Netscaler virtual appliances and
> have found them good.
> If you're after free, you could check out pfSense or Vyatta, I'm not
> 100% sure they have a like for like functionality replacement, it
> depends what functionality you're trying to replace. If you need help
> feel free to contact off list.
>
> Cheers
>
> *Luke Notley**| *Senior Technical Cloud Consultant
>
> Red Ember Solutions | 210 Stirling Street, Perth WA 6000
>
> email: luke.notley@redember.com.au <mailto:luke.notley@redember.com.au>
>
> mobile: +61 410 465 990 office: +61 8 6188 7500 support: +61 8 6188 7501
>
> ------------------------------------------------------------------------
> *From:* AusNOG [ausnog-bounces@lists.ausnog.net] On Behalf Of Ed Hallett
> [ed@teltech.net.au]
> *Sent:* Tuesday, 6 August 2013 8:11 AM
> *To:* ausnog@lists.ausnog.net
> *Subject:* [AusNOG] Application Firewall Recommendations
>
> Hi people,
> Just a simple question, but with a not so simple answer.
> We manage considerable clients with ‘cloud’ based servers within
> Telstra’s utility hosting.
> We used to use TMG as a firewall / gateway / security for clients who
> requested these features, but this is no longer possible.
> I need recommendations on application based (non VM) firewalls which can
> be installed on server 08 / 12 and capable of the same feature set as
> TMG. Not as easy to find now..
> So, I ask my esteemed peers for words of wisdom.
> Well, words, anyway.
> Kind regards,
> Ed Hallett
>
> ------------------------------------------------------------------------
> "Perth based hosting solution provider - get in the cloud with Red Ember
> Solutions - <a href="http://www.redember.com.au"">http://www.redember.com.au"</a>
>
> ------------------------------------------------------------------------
> This message and its attachments are confidential to our organisation
> and subject to legal privilege. If you have received them in error,
> please advise the sender immediately and delete this message. This email
> is subject to copyright, no part of it should be reproduced, adapted or
> transmitted without prior written consent of the copyright owner. Any
> views expressed in this message are those of the individual and may not
> necessarily reflect the view of the company.
>
>
> _______________________________________________
> AusNOG mailing list
> AusNOG@lists.ausnog.net
> <a href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a>
>
_______________________________________________
AusNOG mailing list
AusNOG@lists.ausnog.net
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a>
</pre></body></html>