Network point Yes, but can Yes, can be Yes, but can No No of failure be deployed when fitted be fitted in HA with a with a configuration card card or or configured for high for high availability availability Change to Yes. Yes. No No No. traffic dynamics Traffic Traffic redirected to redirected proxy via to proxy via DNS or DNS or routing routing changes. changes. Negative web None None None None Competes server for server performance resources; impact can affect server on malfunction Network Yes Yes Yes No No separation Scaling TODO TODO TODO TODO Easy; scales implicitly with web servers SSL Termination Termination Passive Passive Not decryption decryption applicable Changes client Yes No No No No IP Address . Response Passive Passive Passive Passive Passive Options (see Active Active Active Active section 3.2 for Intrusive Intrusive Intrusive Intrusive definitions) Content Yes Yes Limited No Yes rewriting Notes: 1. There are two cases when application changes may be required: 1. If the site requires client IP address to operate correctly and it is not possible to modify the configuration of the web server "fake" this information, then the only other solution is to modify the application to take the client IP address information from somewhere else (typically request headers) 2. If the site relies on the SSL private certificates to operate correctly then it will have to modify to retrieve this information from somewhere else (typically request headers).
Network point of failure Yes, but can be deployed in HA configuration Yes, can be when fitted with a card or for high availability Yes, but can be fitted with a card or configured for high availability No No Change to traffic dynamics Yes. Traffic redirected to proxy via DNS or routing changes. Yes. Traffic redirected to proxy via DNS or routing changes. No No No. Negative web server performance impact None None None None Competes for server resources; can affect server on malfunction Network separation Yes Yes Yes No No Scaling TODO TODO TODO TODO Easy; scales implicitly with web servers SSL Termination Termination Passive decryption Passive decryption Not applicable Changes client IP Address Yes . No No No No Response Options (see section 3.2 for definitions) Passive Active Intrusive Passive Active Intrusive Passive Active Intrusive Passive Passive Active Intrusive Content rewriting Yes Yes Limited No Yes Notes: 1. There are two cases when application changes may be required: 1. If the site requires client IP address to operate correctly and it is not possible to modify the configuration of the web server "fake" this information, then the only other solution is to modify the application to take the client IP address information from somewhere else (typically request headers) 2. If the site relies on the SSL private certificates to operate correctly then it will have to modify to retrieve this information from somewhere else (typically request headers).
WAFEC_2_Environment_Support.docx