Amazon's virtual private cloud infrastructure is now the default networking option for multi-tier applications in the AWS cloud. It enables the provisioning of a logically isolated section of the AWS cloud where you can launch resources in a virtual network that you define. You have control over your virtual networking environment, including selection of your own IP address ranges, creation of subnets and configuration of route tables and network gateways.   Riverbed has provided support for Stingray deployments into a VPC since release 9.2. However up until now launching instances into a VPC has required knowledge of the AWS console or the AWS APIs. As of January 13 2014, users who prefer the ease of "1-Click launch" have the ability to launch instances directly into a VPC from the AWS Marketplace.   Riverbed and Amazon used AWS CloudFormation technology to implement this feature. After a user selects the AMI from the AWS Marketplace choices are made for: version (9.5, 9.4 and 9.3r1 can be used with 1-Click into a VPC) region VPC settings instance type key pair   For VPC settings the user is presented with a popup:     Note that the VPC into which the instance will be launched must exist; one cannot be created from this page.   The CloudFormation template can be viewed if desired. Once these details have been provided, the user clicks "Launch with 1-Click" and the instance launch commences: For now, only one Stingray instance can be launched at a time. Future capabilities may provide the ability to launch clusters of two or more Stingray instances into a VPC.   More information: SteelApp for Application Delivery Control & Scalability Whitepaper: Global Load Balancing with SteelApp Traffic Manager Solution Brief: SteelApp Traffic Manager for Disaster Recovery Deployment Guide - Global Load Balancing with Parallel DNS Video: Global Load Balancing in Amazon AWS cloud with Stingray Download SteelApp Developer Edition for Free   ... View more

Where you are now Many web applications serve a geographically distributed user base. Site operators often utilize content delivery network (CDN) services to address performance issues that result from a globally dispersed set of users. As adoption of CDNs has increased users consistently cite challenges that are a consequence of CDN architecture. Foremost among these are: Flexibility: Applications and content are increasingly dynamic, requiring updates on short notice and in real time. The business models and commercial terms imposed by CDN vendors can present barriers to rapid content changes and deployment of new or upgraded applications. When combined with the physical constraints of manipulating content on an infrastructure that is not under direct control, application owners often do not achieve the agility that meets the demands of their industry. Security: To deliver content securely a CDN provider needs copies of the relevant SSL certificates stored on their SSL caching servers throughout their infrastructure, or you would have to use shared SSL certificates. Divulging this SSL information exposes your confidential data to external vulnerabilities and threats. Ease of Management: Requirements can expand beyond the control of a single CDN provider forcing the deployment of a more costly and complex multi-vendor solution to achieve required geographic reach. As a result SLAs are needed with all these CDN providers to deliver the service levels required. However, CDNs have different business models, SLAs and pricing, making management complicated and time-consuming. Scalability: Limited or non-existent programmatic access can limit a CDN’s ability to scale on demand and to manage the application layer that results in higher development costs. In some cases lack of programmability results in an inability to support particular applications. Where you can go today... The proliferation of cloud computing and the increasing sophistication of application delivery controllers (ADCs) has brought into focus new approaches to address the limitations of CDNs. Riverbed has leveraged both technologies to create a platform called the Content Delivery Cloud (CDC). The nucleus of the CDC is Riverbed’s Stingray Traffic Manager. In addition to balancing workloads for applications and services, Stingray controls and optimizes services by inspecting, transforming, prioritizing and routing traffic.  The software form factor of the product allows it to be deployed quickly in virtualized and cloud environments. A CDC is built out starting with a Stingray cluster at the location where the application resides. Acting as a reverse proxy, Stingray terminates requests from end users and load balances traffic over optimized connections to the application. The strain placed on application infrastructure is reduced via networklevel buffering, protocol optimizations, dynamic compression and caching. The result is reduced latency, increased capacity & availability and enhanced service levels. Stingray deployment requires no change to the application so these benefits are achieved quickly and painlessly. To expand on this architecture two advanced features of stingray come into play: Content Caching: With this feature enabled Stingray stores data that has been requested in its local cache. Subsequent requests for the same data can be served directly from the cache, reducing the response time and reducing the load on the application servers. Global Load Balancing (GLB): A service endpoint or URL can resolve to multiple locations. With GLB configured Stingray will route requests to the closest location, reducing the latency that may otherwise be incurred when the request is routed to the origin location and the response is sent from the origin location to the end user. Now additional Stingray Traffic Managers can be deployed at one or more edge locations closer to end users. After GLB routes a request to the best available edge location, Stingray determines if the requested resource is available in its local content cache. If the resource is not available locally, or is dynamic, the edge Traffic Manager requests it from the origin site and stores static objects for subsequent requests. The CDC can grow and shrink as required. As demand increases, a new edge location can be quickly deployed. Similarly, an edge location can be removed as traffic levels decrease, without impacting the ability to deliver the service. The geographical reach that cloud providers deliver means an application owner can build out a CDC for a fraction of the cost of similar CDN services. Combined with tangible improvements in flexibility, control, security and scalability, the choice becomes clear. Riverbed has partnered with leading cloud service provider, Joyent, to make deployment even more straightforward. Their points of presence and the ability to deploy Stingray directly from the Joyent self-service portal allow a complete CDC infrastructure to be built in just hours. For more information on the Riverbed Stingray ADC and Content Delivery Cloud solution, visit: Stingray Content Delivery Cloud. For more information on the CDC in the Joyent cloud please visit Joyent CDC. ... View more

The AWS Marketplace provides a "launch with 1-click" button to simplify deployment of the Pulse Secure Virtual Traffic Manager in EC2.   If you accept the Marketplace defaults a new security group is created for you automatically. The security group is fine for single instances of vTM, but attempts to cluster traffic managers associated with this security group will fail.   Prior to clustering traffic managers, modify your security group to open ports 9080 and 9090 for UDP traffic. For more information read the Before You Begin section in the Cloud Services Installation and Getting Started Guide - see vADC Product Documentation ... View more

Written by Raja Srinivasan and Jim Young on November 1, 2012 The most dreaded words a CIO or VP of IT is likely to hear today is : "Your web site has been hacked!". In the last year, a group of hackers called “Anonymous” have been targeting web sites as a way to express their displeasure over various corporate activities from SOPA, to Government interference in commerce, to expressing displeasure over the Pope’s visit to Mexico.  Many of these attacks are targeted at commercial e-commerce web sites and government institutions like the FBI, CIA, Department of Justice etc.  While the main aim of these attacks appear to be just disabling the web site, they are also a prelude to other activities like stealing data from web site. These attacks often lead to... Downtime Revenue loss Data loss Hijacking These attacks have also led to many copycat style attacks and are increasing day by day.  So what can an organization do to protect itself against these attacks? If you are using Stingray Traffic Manager there are a few simple things you can do to help overcome some of these. We will now look at some of the options. SYN Flood. A good network firewall would help protect your web site from these type of attacks. Denial of Service Attacks. These are targeted attacks against specified web sites and are really good at consuming compute resources. Stingray Traffic Manager can help stop some of these attacks cold.  An example of how to use Traffic Script to stop these attacks is described below. SQL Injection Attacks. These often lead to data being stolen and used for nefarious activities. Using the Application Firewall Module with Stingray Traffic Manager can help stop these attacks. Stopping Denial of Service Attacks: One of the features in the Stingray Traffic Manager is service protection.  You can configure the service protection class in the Stingray catalog. Once defined, a service protection class is assigned to a virtual server. The limits specified in the service protection class are applied to each connection received by the virtual server. A service protection class allows configuration for connection limiting, access restrictions (blacklisted and whitelisted IP addresses), HTTP integrity checks and service protection rules. To help protect against attacks like the ones launched by The Anonymous Group, you can use the following setup: a. Connection Limiting This feature allows an administrator to configure limits on the number of connections that the traffic manager will allow from individual IP addresses. The settings are: the number of simultaneous connections that will always be allowed from one IP address, even if it is in a group whose connections are being capped. the maximum number of simultaneous connections that will be allowed from the same IP address. the maximum number of simultaneous connections that will be allowed from the 10 busiest IP addresses. By combining this with the max_1_connections setting a site can be configured to allow individual users a greater number of connections when the site is not busy and then restrict the number of connections each user is allowed when you have more visitors. b. Service Protection Rule The rules are created using Stingray’s built-in TrafficScript language. You can construct a rule which examined both the raw URL and the Referer header.  By careful monitoring you can determine if the URL of traffic contained a specific string or the Referer contained a specific domain name. With just a few lines of TrafficScript you are now able to block the traffic. Sample code: $rawurl = http.getRawURL(); if ( string.contains( $rawurl, “anonmsg=” ) ) { log.info ( request.getRemoteIP() ); log.info ( $rawurl ); http.sendResponse( “403 Permission Denied”, “text/html”, “invalid request”, “”); connection.discard(); } $referer = http.getHeader ( “Referer” ); if ( string.contains( $referer, “dominioncoding.com” ) ) { log.info ( $referer); http.sendResponse( “403 Permission Denied”, “text/html”, “invalid request”, “”); connection.discard(); } Rate classes can also be used as part of the defense mechanism. Rate classes dynamically control the rate at which incoming requests are processed. Request rate shaping allows you to specify limits on a wide range of events, with very fine grained control over how events are identified.  You can impose per-second and per-minute rates on the events. Using Stingray’s Service Protection Classes, Rate Classes, and configuring the Application Firewall Module would help you in defending your web site against attacks like those from the Anonymous Group and reduce  unexpected downtime. For more information please refer to the Stingray user guide. ... View more