Recommendations for configuring a load balancer for a Cluster ActiveGate

[MAkimov]

The documentation provides information about adding a load balancer in front of a Сluster ActiveGate.

What are the guidelines for setting it up?

Also a question about the security of such a scheme, can an attacker get into the internal network with such a scheme?

[Ramesh_Nadar · Accepted solution]

Hello Mikhail A ,

Even we are in progress to set Cluster AG.

Steps which we are following up are which may help you as well.

• Our cluster AG is DMZ server. Private zone.
• Get External IP for DMZ server
• Get Public IP for DMZ server
• Any IP to Public IP port opening
• Obtain LB virtual IP from you network/LB team.
• Do natting between Public Ip and LB
• Map between LB to DMZ external IP (service port - 9999)
• Get DNS for your server internal and external IP.
  • Generate csr, jks file
  • Get SSL certificate
• Public IP to DMZ server DNS whitelisting.
• Implement SSL certificate in LB

As certificate will be SSL not no major security impact.

Cheers!

R

[MAkimov]

What parameters are checked by the AG from the js agent? What headers from exactly understands the data from the agent ?

[Radoslaw_Szulgo · Accepted solution]

What are the guidelines for setting it up?

The only requirement from Dynatrace side is to open required incoming/outgoing network ports and preserve incoming headers - as cluster node will verify them to make sure they come from a valid source. Load balancing might be implemented as round-robin or based on health checks that execute /rest/health on port :9999.

I'll try to add something to our documentation pages. Thanks!

Can an attacker get into the internal network with such a scheme?

Dynatrace recommends closing all ports that are not required for all components - incl. customer-provided Load Balancer (LB). For example, LB can accept only 443 and redirect that only to 9999. All other is closed.

[MAkimov]

Thank Radoslaw

what headers AG checks to verify that the request came from the correct source ?

Is it only x-dynatrace-application ?

[Radoslaw_Szulgo]

The header that needs to be transmitted is"Server" : "ruxit security gateway"

[MAkimov]

A couple more questions.

Does AG not verify that the request came from our js?

Is it necessary for the balancer to forward/save the client's ip address or all the necessary information for monitoring RUM is contained in the request body ?

[MAkimov]

on the second additional question found the answer in the documentation:

Be sure to configure the load balancer to set the x-forwarded-for parameter for all forwarded requests. This parameter contains the IP address of the original request. Dynatrace needs this parameter to determine where the request originated from

[Radoslaw_Szulgo]

LB does need to send the true client IP otherwise we show the IP address as being that of the load balancer, this page lets you set which headers are looked at Settings -> Web and mobile monitoring --> IP determination

[MAkimov]

Hello @Radoslaw S.

Could you please tell me what kind of validation and verification does Cluster ActiveGate for data from js agent (agentless) ?

[Radoslaw_Szulgo]

Dynatrace checks payload and URL (parameters). Additionally user-agent header.

[MAkimov]

does checks ActiveGate or the Dynatrace server?

Does ActiveGate verify that the request came from our js-agent (what parameters are checked)?

Or ActiveGate simply redirects all traffic to the server ?

Thanks!

[Radoslaw_Szulgo]

AG aggregates and redirect the traffic to Cluster nodes. Then cluster node (server) extracts the data and validates.

[Radoslaw_Szulgo]

AG only does some checks on the querystring/url and a payload length restrictions

[MAkimov]

thanks a lot for the answers!

the last question - is the data of js-agent in protobuff format ?

[Radoslaw_Szulgo]

between agent and AG - it's just a string key-value pairs. between AG and Cluster node - protobuf.

[MAkimov]

Is it possible to fix the parameters of the AG SSL certificate in the js to prevent the transfer of metrics to a fake server?

[Radoslaw_Szulgo]

I don't understand the question. Can you please give some examples?

[fstekelenburg]

Care needs to be taken if also F5 ASM is involved. 
See: CORS error on agentless RUM page with JavaScript t... - Dynatrace Community