up vote 0 down vote favorite
share [g+] share [fb]

Need to setup a policy on juniper netscreen firewall that would allow access to a content hosted by akamai. There are two options: to use an IP address or hostname. Using hostname does not work with akamai, because it resolves to a different IP address with almost every client request. Using IP address is a bit scary as it seems akamai owns the whole Internet IP address space :) What is the solution?

link|improve this question
feedback

3 Answers

up vote 0 down vote

I don't understand why hostname is a problem, that's how distributed content is supposed to work. Maybe consider using a proxy server, and allow that device to get anywhere?

link|improve this answer
Hi Spaceman, thank you for your response. When you configure policy on netscreen firewall using a hostname firewall resolves it to IP address and stores in the cashe. For the clients that access Internet through that firewall, the same hostname resolves to a different IP address with every request that does match with the IP address that firewall has stored in the cashe and the request gets dropped by the firewall. Proxy server is not an option for me, I need a direct connection. – user76853 Apr 2 '11 at 2:47
Sorry, I meant to say the IP that client tries to access does NOT match the cashed by firewall IP address... – user76853 Apr 2 '11 at 2:56
feedback
up vote 0 down vote

I'm wondering why you can't use a proxy, because that's basically what Akamai content delivery servers are. Or are you using some other Akamai service, such as their IP acceleration product? There are other kludgy things you can do such as hard code the Akamai server IP address in a hosts file, but that defeats the point of the CDN and Akamai turn machines off and on quite regularly. What content are you fetching? User content or machine content such as virus/software updates?

link|improve this answer
Some hosted Exchange service providers offer akamai based outlook web access. I would like to provide clients with direct https connection to OWA. I was hoping that someone familiar with juniper firewalls will offer a solution. – user76853 Apr 3 '11 at 6:32
Do you really need a direct connection and not via a SSL proxy under your control? Is this a technical restriction or a business restriction? An alternative is to bypass Akamai and go straight to the origin server if you know where it is (Akamai debug headers can help here). But you'll lose any benefits of the Akamai service. Disclosure: I used to work for Akamai Professional Services and this kind of thing cropped up all the time. – lapthorn Apr 3 '11 at 10:51
Satellite offices access Internet via web proxy in main office through VPN tunnel. I want a direct connection for OWA and Outlook Anywhere (RPC over HTTPS) for better speed. I can bypass akamai by going to origin server, but am looking for a solution that would allow use of akamai. – user76853 Apr 3 '11 at 15:54
feedback
up vote 0 down vote

Had same issue before, you basically are going to have to setup a Proxy. Plenty out there paid/free/cheap. Check the vmware area for prebuilt VMs. Or pony up for a bluecoat or something like them.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.