IBM Security Web Gateway Appliance Administration Guide

346 Pages·2012·1.72 MB·English

IBM Security Access Manager for Web
Version 7.0
IBM Security Web Gateway Appliance
Administration Guide
(cid:1)(cid:2)(cid:3)
SC22-5432-00

IBM Security Access Manager for Web
Version 7.0
IBM Security Web Gateway Appliance
Administration Guide
(cid:1)(cid:2)(cid:3)
SC22-5432-00
Note
Beforeusingthisinformationandtheproductitsupports,readtheinformationin“Notices”onpage321.
Editionnotice
Note: Thiseditionappliestoversion7,release0,modification0ofIBMSecurityAccessManager(product
number5724-C87)andtoallsubsequentreleasesandmodificationsuntilotherwiseindicatedinneweditions.
©CopyrightIBMCorporation2012.
USGovernmentUsersRestrictedRights–Use,duplicationordisclosurerestrictedbyGSAADPScheduleContract
withIBMCorp.
Contents
Figures . . . . . . . . . . . . . . . v Chapter 5. Monitoring: Analysis and
Diagnostics. . . . . . . . . . . . . 19
Tables . . . . . . . . . . . . . . . vii Viewingtheeventlog . . . . . . . . . . . 19
Managingreverseproxylogfiles . . . . . . . 19
About this publication . . . . . . . . ix Viewingmemorystatistics . . . . . . . . . 20
ViewingCPUutilization . . . . . . . . . . 20
Intendedaudience . . . . . . . . . . . . ix
Viewingstorageutilization . . . . . . . . . 21
Accesstopublicationsandterminology . . . . . ix
Viewingapplicationinterfacestatistics . . . . . 22
Relatedpublications . . . . . . . . . . xii
Viewingreverseproxytraffic . . . . . . . . 22
Accessibility. . . . . . . . . . . . . . xiv
Viewingreverseproxythroughput . . . . . . 23
Technicaltraining . . . . . . . . . . . . xiv
ArchivinganddeletingWebReverseProxylogfiles
Supportinformation . . . . . . . . . . . xiv
withthecommand-lineinterface . . . . . . . 23
Chapter 1. Overview . . . . . . . . . 1
Chapter 6. Secure: Reverse Proxy
Applianceformat. . . . . . . . . . . . . 1
Settings . . . . . . . . . . . . . . 25
SupportedWebReverseProxyfunctionality . . . . 1
Tipsonusingtheappliance . . . . . . . . . 3 Migration . . . . . . . . . . . . . . . 25
Configurationchangescommitprocess . . . . . 28
Chapter 2. Getting Started . . . . . . . 5 Runtimecomponents . . . . . . . . . . . 30
Managingruntimecomponentswithlocal
Hardwareappliancetasks . . . . . . . . . . 5
managementinterface. . . . . . . . . . 30
Connectingcablesandstartingtheappliance . . 5
Managingruntimecomponentswithwebservice 34
Optionstoconfigurethehardwareappliance . . 5
Webreverseproxy . . . . . . . . . . . . 51
Connectingaserialconsoletotheappliance. . . 5
Managingreverseproxywithlocalmanagement
DeterminingthesystemIPaddress. . . . . . 6
interface . . . . . . . . . . . . . . 52
Virtualappliancetasks . . . . . . . . . . . 6
Managingreverseproxywithwebservice . . . 76
Settingupthevirtualnetwork . . . . . . . 6
DynamicURL(DynURL)configurationfile
InstallingthevirtualapplianceusingVMware . . 6
management . . . . . . . . . . . . . 149
Commontasks. . . . . . . . . . . . . . 7
ManagingDynURLconfigurationfileswith
Command-lineinterfaceinitialappliancesettings
localmanagementinterface. . . . . . . . 149
wizard . . . . . . . . . . . . . . . 7
ManagingDynURLconfigurationfileswithweb
LocalmanagementinterfaceApplianceSetup
service. . . . . . . . . . . . . . . 151
wizard . . . . . . . . . . . . . . . 8
JunctionMappingTable(JMT)configurationfile
management . . . . . . . . . . . . . 159
Chapter 3. Managing the appliance . . . 9
ManagingJMTconfigurationfileswithlocal
Localmanagementinterface . . . . . . . . . 9 managementinterface . . . . . . . . . 160
Command-lineinterface . . . . . . . . . . 9 ManagingJMTconfigurationfileswithweb
Webservice . . . . . . . . . . . . . . 10 service. . . . . . . . . . . . . . . 162
Requiredheaderforcallingawebservice . . . 10 ClientCertificateCDASfilemanagement . . . . 170
Webserviceresponses. . . . . . . . . . 11 ManagingclientcertificateCDASfileswithlocal
managementinterface . . . . . . . . . 170
Chapter 4. Home: Appliance Dashboard 13 ManagingclientcertificateCDASfileswithweb
Viewingsystemnotifications . . . . . . . . 13 service. . . . . . . . . . . . . . . 172
Viewingreverseproxyhealthstatus . . . . . . 13 FormsBasedSSO(FSSO)configurationfile
Viewingdiskusage. . . . . . . . . . . . 14 management . . . . . . . . . . . . . 180
ViewingIPaddresses . . . . . . . . . . . 14 ManagingFSSOconfigurationfileswithlocal
Viewingfront-endloadbalancerhealthstatus . . . 14 managementinterface . . . . . . . . . 180
Viewingaverageresponsetimestatistics. . . . . 15 ManagingFSSOconfigurationfileswithweb
Viewingsecurityactionstatistics . . . . . . . 15 service. . . . . . . . . . . . . . . 183
Viewingcertificateexpiry. . . . . . . . . . 16 HTTPTransformationRulefilemanagement . . . 191
Viewingpartitioninformation . . . . . . . . 16 ManagingHTTPtransformationrulefileswith
Viewingreverseproxythroughput . . . . . . 17 localmanagementinterface. . . . . . . . 191
Viewingnetworktraffic . . . . . . . . . . 17 ManagingHTTPtransformationrulefileswith
webservice . . . . . . . . . . . . . 193
SSLcertificates . . . . . . . . . . . . . 202
©CopyrightIBMCorp.2012 iii
ManagingSSLcertificateswithlocal Configuringstaticroutes . . . . . . . . 266
managementinterface . . . . . . . . . 202 Front-endloadbalancer . . . . . . . . . 266
ManagingSSLcertificateswithwebservice . . 208 Hostsfilemanagement . . . . . . . . . 287
SSOkeymanagement . . . . . . . . . . 231 Packettracing . . . . . . . . . . . . 293
ManagingSSOkeyswithlocalmanagement Systemsettings. . . . . . . . . . . . . 299
interface . . . . . . . . . . . . . . 231 Configuringdateandtimesettings . . . . . 299
ManagingSSOkeyswithwebservice . . . . 233 Configuringadministratorsettings . . . . . 299
LTPAkeys . . . . . . . . . . . . . . 236 Managementauthentication . . . . . . . 299
ManagingLTPAkeyswithlocalmanagement ManagementSSLcertificate . . . . . . . 304
interface . . . . . . . . . . . . . . 237 Managingadvancedtuningparameters. . . . 307
ManagingLTPAkeyswithwebservice. . . . 238 Managingsnapshots . . . . . . . . . . 308
Querysitecontents . . . . . . . . . . . 242 Managingsupportfiles . . . . . . . . . 308
Managingquerysitecontentsfileswithlocal Configuringsystemalerts . . . . . . . . 309
managementinterface . . . . . . . . . 242 Restartingorshuttingdowntheappliance . . 312
Retrievingallquerysitecontentsfilenames
withwebservice . . . . . . . . . . . 242 Chapter 8. Troubleshooting . . . . . 313
Retrievingthecontentsofaquerysitecontents
IPMItool . . . . . . . . . . . . . . . 313
filewithwebservice . . . . . . . . . . 243
Runningself-diagnostictests(hardwareappliance
Exportingaquerysitecontentsfilewithweb
only) . . . . . . . . . . . . . . . . 313
service. . . . . . . . . . . . . . . 244
ErrorHPDBG1005E:CouldnotcontacttheLDAP
server . . . . . . . . . . . . . . . . 314
Chapter 7. Manage: System Settings 247
InstallingfirmwarefromaUSBbootdrive:
Updatesandlicensing . . . . . . . . . . 247 Windows. . . . . . . . . . . . . . . 314
Viewingtheupdateandlicensingoverview . . 247 InstallingfirmwarefromaUSBbootdrive:Linux 315
Installingupdates . . . . . . . . . . . 247 InstallingfirmwarefromaUSBbootdrive:MacOS 316
Configuringtheupdateschedule. . . . . . 248 Erasingthehardwareappliance:Windows . . . 316
Configuringupdateserversettings . . . . . 248 Erasingthehardwareappliance:Linux. . . . . 317
Viewingupdatehistory . . . . . . . . . 251 Erasingthehardwareappliance:MacOS . . . . 318
Installingafixpack . . . . . . . . . . 251 Technicalsupport . . . . . . . . . . . . 319
Installingalicense. . . . . . . . . . . 252
Managingfirmwaresettings . . . . . . . 252 Notices . . . . . . . . . . . . . . 321
NetworkSettings . . . . . . . . . . . . 253
Applicationinterfacemanagement . . . . . 253 Index . . . . . . . . . . . . . . . 325
Configuringmanagementinterfaces. . . . . 265
iv IBMSecurityAccessManagerforWebVersion7.0: IBMSecurityWebGatewayApplianceAdministrationGuide
Figures
1. Front-endloadbalancer . . . . . . . . 267
©CopyrightIBMCorp.2012 v
vi IBMSecurityAccessManagerforWebVersion7.0: IBMSecurityWebGatewayApplianceAdministrationGuide
Tables
1. WebSEALfeaturesthattheappliancedoesnot 6. Front-endloadbalancerlevelattributes 271
support . . . . . . . . . . . . . . 2 7. Servicelevelattributes . . . . . . . . 272
2. HTTPerrorresponsecodes . . . . . . . 11 8. Serverlevelattributes. . . . . . . . . 273
3. Directorystructure . . . . . . . . . . 25 9. Servicelevelattributes . . . . . . . . 279
4. Configurationparameters. . . . . . . . 39 10. Serverlevelattributes. . . . . . . . . 280
5. Unconfigurationparameters . . . . . . . 43 11. Authenticationconfigurationparameters 301
©CopyrightIBMCorp.2012 vii
viii IBMSecurityAccessManagerforWebVersion7.0: IBMSecurityWebGatewayApplianceAdministrationGuide