True transparent proxy to support multiple HTTP/S web applications on same IP and port on a data communication network
A true transparent proxy for a web application firewall is provided. Granular network security policies are applied on a per web application basis using unique SSL inspection certificates for web applications sharing a common IP address.
1. A computer-implemented method in a web application firewall (WAF) of a data communication network, at least partially implemented in hardware and coupled to a data communication network, for providing true transparent proxy to multiple web sites, the method comprising:
publishing, by a processor of the WAF, each of a plurality of real servers on a fully qualified domain name (FQDN), associated with a COMMON domain name Internet protocol (IP) address and each FQDN protecting a web-based application running on the FQDN;
assigning and storing, by a memory element of the WAF, a secure socket layer (SSL) inspection certificate to each of the FQDN real servers;
receiving, at a network communication interface of an access point (AP) coupled to the data communication network, network traffic at a single IP address on the data communication network, the network traffic having multiple web site destinations for web-based applications;
responsive to the received network traffic, retrieving an SSL inspection certificate for each of the FQDN real servers associated with the multiple web site destinations; and
forwarding the network traffic securely to the web site destinations;
wherein each SSL inspection certificate has a separate network security policy corresponding to a specific web-based application;
wherein the received network traffic is sourced from a firewall between the WAF and the data communication network and destined to the plurality of web-based applications.
2. The method of claim 1 , wherein the network traffic uses the HTTPS (hypertext protocol secure) standard.
3. A non-transitory computer-readable medium storing instructions that, when executed by a processor, perform a computer-implemented method in a web application firewall (WAF) of a data communication network and coupled to a wireless network, for providing true transparent proxy to multiple web sites, the method comprising:
publishing, by a processor of the WAF, each of a plurality of real servers on a fully qualified domain name (FQDN), associated with a domain name Internet protocol (IP) address and each FQDN protecting a web-based application running on the FQDN;
assigning and storing, by a memory element of the WAF a secure socket layer (SSL) inspection certificate to each of the FQDN real servers;
receiving, at a network communication interface of an access point (AP) coupled to the data communication network, network traffic at a single IP address on the data communication network, the network traffic having multiple web site destinations for web-based applications;
responsive to the received network traffic, retrieving an SSL inspection certificate for each of the FQDN real servers associated with the multiple web site destinations; and
forwarding the network traffic securely to the web site destinations;
wherein each SSL inspection certificate has a separate network security policy corresponding to a specific web-based application;
wherein the received network traffic is sourced from a firewall between the WAF and the data communication network and destined to the plurality of web-based applications.
4. A web application firewall (WAF) system of a data communication network, at least partially implemented in hardware and coupled to a data communication network, for providing true transparent proxy to multiple web sites, the system comprising:
a secure socket layer (SSL) module to publish each of a plurality of real servers on a fully qualified domain name (FQDN), associated with a domain name Internet protocol (IP) address and each FQDN protecting a web-based application running on the FQDN;
a memory element of the WAF system to assign and store a secure socket layer (SSL) inspection certificate to each of the FQDN real servers;
a network communication interface of the WAF system, coupled to the data communication network, to receive network traffic at a single IP address on the data communication network, the network traffic having multiple web site destinations for web-based applications; and
the SSL module to retrieve an SSL inspection certificate for each of the FQDN real servers associated with the multiple web site destinations,
wherein the network communication interface forwards the network traffic securely to the web site destinations;
wherein each SSL inspection certificate has a separate network security policy corresponding to a specific web-based application;
wherein the received network traffic is sourced from a firewall between the WAF and the data communication network and destined to the plurality of web-based applications.