[互联网]F5培训.ppt

SSL Concepts Encrypted at each end Certificates Keys SSL Accelerator Cards Processing work of encryption / decryption done by card Takes load off Server Network Packet Encrypted SSL Termination Decrypted Encrypted SSL Termination Advantages SSL key exchange done by hardware SSL bulk encryption done by hardware Centralize certificate management Offload SSL traffic from Web Servers Allows rule processing cookie persistence V9 Traffic Flow through BIG-IP Client sends Encrypted packet Internet BIG-IP takes packet off Network and Decrypts VS load balances to Nodes Response packet is Re-encrypted before external Network Client SSL Plus Server SSL Encrypted Encrypted Decrypted inside BIG-IP SSL Acceleration Chip or card Encryption / Decryption done with hardware – faster 1500 – 100 to 2000 TPS 3400 – 100 to 5000 TPS 6400 – 100 to 15000 TPS 6800 – 100 to 20000 TPS Create SSL Profile Point VS to Profile SNATs Internet 02 Many-to-one mapping Traffic to SNAT Address is refused Can share IP with Virtual Server SNATs – Typical Traffic Flow Internet 02 :1111 ? 03:80 02:2222 ? 03:80 When one of the “many” initiates traffic via the BIG-IP, the source address is translated to the SNAT address and athe packet is forwarded. Note that the source port is typically translated as well. SNATs – Typical Traffic Flow Internet 02 03:80? :1111 03:80? 02:2222 When the response is received by the BIG-IP, the destination address and port is translated to that of the originating device. SNAT Configuration Internet 02 Who can be changed Changed to what Where packet arrived from SNATs Internet 02 Who can be changed Changed to what Where packet arrived from * * * * * * Point out… Obviously F5 is a solid organization with market leading products F5 products impact people’s daily lives. If you’ve… Traded a stock Bought an airline ticket Posted something on e-Bay Shipped a package Seen a doctor Banked online …you’ve used an F5 product. We make using applications eas