cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Recommendations for configuring a load balancer for a Cluster ActiveGate

MAkimov
Mentor

The documentation provides information about adding a load balancer in front of a Сluster ActiveGate.

What are the guidelines for setting it up?


Also a question about the security of such a scheme, can an attacker get into the internal network with such a scheme?

18 REPLIES 18

Ramesh_Nadar
Advisor

Hello Mikhail A ,

Even we are in progress to set Cluster AG.

Steps which we are following up are which may help you as well.

  • Our cluster AG is DMZ server. Private zone.
  • Get External IP for DMZ server
  • Get Public IP for DMZ server
  • Any IP to Public IP port opening
  • Obtain LB virtual IP from you network/LB team.
  • Do natting between Public Ip and LB
  • Map between LB to DMZ external IP (service port - 9999)
  • Get DNS for your server internal and external IP.
    • Generate csr, jks file
    • Get SSL certificate
  • Public IP to DMZ server DNS whitelisting.
  • Implement SSL certificate in LB

As certificate will be SSL not no major security impact.


Cheers!

R

What parameters are checked by the AG from the js agent? What headers from exactly understands the data from the agent ?

Radoslaw_Szulgo
Dynatrace Guru
Dynatrace Guru

What are the guidelines for setting it up?

The only requirement from Dynatrace side is to open required incoming/outgoing network ports and preserve incoming headers - as cluster node will verify them to make sure they come from a valid source. Load balancing might be implemented as round-robin or based on health checks that execute /rest/health on port :9999.

I'll try to add something to our documentation pages. Thanks!


Can an attacker get into the internal network with such a scheme?

Dynatrace recommends closing all ports that are not required for all components - incl. customer-provided Load Balancer (LB). For example, LB can accept only 443 and redirect that only to 9999. All other is closed.

Senior Product Manager,
Dynatrace Managed expert

Thank Radoslaw

what headers AG checks to verify that the request came from the correct source ?

Is it only x-dynatrace-application ?

The header that needs to be transmitted is"Server" : "ruxit security gateway"

Senior Product Manager,
Dynatrace Managed expert

A couple more questions.

Does AG not verify that the request came from our js?


Is it necessary for the balancer to forward/save the client's ip address or all the necessary information for monitoring RUM is contained in the request body ?

on the second additional question found the answer in the documentation:

Be sure to configure the load balancer to set the x-forwarded-for parameter for all forwarded requests. This parameter contains the IP address of the original request. Dynatrace needs this parameter to determine where the request originated from

LB does need to send the true client IP otherwise we show the IP address as being that of the load balancer, this page lets you set which headers are looked at Settings -> Web and mobile monitoring --> IP determination


Senior Product Manager,
Dynatrace Managed expert

MAkimov
Mentor

Hello @Radoslaw S.

Could you please tell me what kind of validation and verification does Cluster ActiveGate for data from js agent (agentless) ?

Dynatrace checks payload and URL (parameters). Additionally user-agent header.
Senior Product Manager,
Dynatrace Managed expert

does checks ActiveGate or the Dynatrace server?

Does ActiveGate verify that the request came from our js-agent (what parameters are checked)?

Or ActiveGate simply redirects all traffic to the server ?

Thanks!

AG aggregates and redirect the traffic to Cluster nodes. Then cluster node (server) extracts the data and validates.

Senior Product Manager,
Dynatrace Managed expert

AG only does some checks on the querystring/url and a payload length restrictions

Senior Product Manager,
Dynatrace Managed expert

thanks a lot for the answers!

the last question - is the data of js-agent in protobuff format ?

between agent and AG - it's just a string key-value pairs. between AG and Cluster node - protobuf.

Senior Product Manager,
Dynatrace Managed expert

Is it possible to fix the parameters of the AG SSL certificate in the js to prevent the transfer of metrics to a fake server?

I don't understand the question. Can you please give some examples?

Senior Product Manager,
Dynatrace Managed expert

fstekelenburg
DynaMight Pro
DynaMight Pro

Care needs to be taken if also F5 ASM is involved. 
See: CORS error on agentless RUM page with JavaScript t... - Dynatrace Community