The F5 DDoS Mitigation Reference Architecture | F5 White Paper

Size: px

Start display at page:

Download "The F5 DDoS Mitigation Reference Architecture | F5 White Paper"

しょうぶふしはら
5 years ago
Views:

1 F5 DDoS F5DDoS White Paper

2 F5 DDoS 3 DDoS 4 3 DDoS 3 DDoS 4 DDoS 6 F5 7 8 DDoS DNS DDoS FSI DDoS 13 DDoS 14 SMB DDoS

3 F5 DDoS 2012 DDoS DDoS F5 DDoS 1 DNS 3 4 DDoS 2 CPU F5 DDoS DDoS 4 DDoS 4 F CPU F5 DDoS DDoS DDoS F5 F5 3

4 F5 DDoS DDoS 1 4 DDoS DDoS Web Prolexic Verizon VeriSign F5 Web F5 F5 F5 IP /IDS/IPS Webroot Sourcefire F5 1: DDoS DDoS DDoS DDoS 1 Gbps 50 Gbps DDoS : Web POST 4

5 F5 DDoS DDoS DDoS DDoS SYN DDoS F5 HTTP DNS F5 DDoS Web Web HTTP Web DDoS F5 Web F5 Web Web PCI Web F5 SSL Web SSLL 1 5

6 F5 DDoS / / IDS/IPS DDoS IDS/IPS 4 1 IDS/IPS Web IP IP DDoS DoS IP F5 2 DDoS 2 DDoS SSL Web CPU 1 2 ISP : SSL: SSL SSL DDoS ISPa/b DNS: DNS DNS DNS IPS HTTP: Slowloris POST POST/GET E- 1: 2 F5 DoS 6

7 F5 DDoS 1. Web F5 2 F5 DDoS BIG-IP Advanced Firewall Manager (AFM) BIG-IP Local Traffic Manager (LTM) BIG-IP Global Traffic Manager (GTM) BIG-IP Application Security Manager (ASM) 7

8 F5 DDoS 1 2 DNS F5 BIG-IP AFM BIG-IP LTM BIG-IP GTM BIG-IP LTM BIG-IP ASM DNS Express OSI DNS 1 IP SYN ICMP TCP SSL Web Slowloris POST Apache Killer RUDY/Keep Dead SSL DNS DNSSEC UDP DNS NXDOMAIN DNSSEC 2: F5 DDoS 2 DDoS /Web DDoS 1 2 DDoS 1 1 SYN ICMP 80 90%F5 IP DDoS IP 8

9 F5 DDoS DNS 1 DMZ DNS 4 DNS 1 L3-4 DNS + 2 AFM LTM VIPRION + IPIPI DNS GTM BIG-IP 2: DDoS 1 DDoS : TCP SSL TCP 4 DDoS 1 TCP SSL SSL 50, ,000 SSL TCP SSL 9

10 F5 DDoS 3 F5 TCP SSL VIPRION Virtual Edition : F5 2 2 CPU Web F5 irules IDS/IPS 2 SSL 1 SSL SSL 2 L7 WEB + SSL ASM LTM BIG-IP 3: DDoS 2 10

11 F5 DDoS DDoS : GET GET POST GET F Mbps GET20 Gbps GET DDoS CAPTCHA irules irules F5 DDoS 2 Web DNS DDoS DNS HTTP 2 DNS DNS DNS DNS DNS DNS DDoS DNS DNS DNS NXDOMAIN Non-Existent Domain 11

12 F5 DDoS BIG-IP GTM DNS DNS DNS Express DNS Express DNS NXDOMAIN NXDOMAIN DNS DNS DNS DNS DNS BIG-IP GTM DNS Express BIG-IP AFM DNS DDoS 1 DNS DNS DMZ BIG-IP GTM BIG-IP AFM DNS DNS 3 1. FSI SMB) F5 7 12

13 F5 DDoS FSI DDoS DDoS ISPa 1:L3-4 DNS + 2 2:L7 Web + SSL ISPb BIG-IP DDoS ISP VIPRION + IPIPI DNS HSM FIPS140 SSL SSL BIG-IP BIG-IP Advanced Firewall Manager BIG-IP Local Traffic Manager BIG-IP Global Traffic Manager BIG-IP Application Security Manager + IP 4: FSI F5 DDoS FSI FSI DDoS FSI FSI DDoS FSI FSI / FSI FSI DDoS CPU DDoS 1 2 BIG-IP ASM 13

14 F5 DDoS 1 2 DNS F5 VIPRION VIPRION : BIG-IP AFM BIG-IP : BIG-IP ASM BIG-IP 4: FSI DDoS NGFW DDoS ISPa 1: L3-4 DNS + DNS + 2 2: L7 Web + SSL DDoS ISPb ISP DDoS BIG-IP + IP IPI SSL BIG-IP BIG-IP Advanced Firewall Manager BIG-IP Local Traffic Manager BIG-IP Global Traffic Manager BIG-IP Access Policy Manager BIG-IP Application Security Manager + IP 5: F5 DDoS DDoS FSI NGFW / NGFW DDoS 1 ISP DDoS 14

15 F5 DDoS NGFW 2 2 CPU BIG-IP ASM F5 SSL 1 SSL 1 2 DNS F5 BIG-IP : BIG-IP AFM BIG-IP : BIG-IP ASM BIG-IP 5: SMB DDoS NGFW DDoS ISPa L3-7 DNS + DNS + Web + DDoS ISPb ISP DDoS BIG-IP BIG-IP Advanced Firewall Manager BIG-IP Local Traffic Manager BIG-IP Global Traffic Manager BIG-IP Access Policy Manager BIG-IP Application Security Manager 6: F5 DDoS 15

16 F5 DDoS SMB SMB 1 DDoS 1 BIG-IP ASM F5 DDoS F5 BIG-IP : BIG-IP GTM : BIG-IP ASM : BIG-IP AFM : BIG-IP APM 6: SMB 16

17 F5 DDoS 7F5 SYN SYN 1 ICMP HTTP JavaScript SSL 2 TCP SSL VIPRION Gbps Gbps 350,000* RPS 16,000 TPS V 80 Gbps Gbps 175,000* RPS 16,000 TPS V 40 Gbps Gbps 131,000 RPS 16,000 TPS v 30 Gbps Gbps 131,000 RPS 16,000 TPS : DDoSF5. 17

BIG‑IP Access Policy Manager | F5 Datasheet

BIG‑IP Access Policy Manager | F5 Datasheet 2 3 5 7 8 Secure Web Gateway 10 12 BIG-IP APM 13 F5 Global Services 13 13 BIG-IP Access Policy Manager (APM) LAN BIG-IP APM IT LAN 1 Web OAM XenApp Exchange Web Web Web Web Web web BIG-IP APM LAN IT /