0

at the moment, our application servers are directly accessable on the internet, like the following picture shows.

one server who takes it all

With this in mind, it would be aful if a server crashes (hardware-failure) or stops doing it work somehow.

To prevent this, i would like to split my application server and put a load balancer in front of it, like the next picture shows. A separate server for the database shows up here, but this is not part of the question, but a note, that database will be extracted from the APS, too.

load balancer and more AP-servers

Whilst the WAF (modsecurity for apache) run on the application servers at the moment, would you put the WAF on the loadbalancer on the new configuration? I thought about using NGINX as a proxy/loadbalancer for it. Or should i leave it on the APS? I am also not sure if there is any influence if the TLS-termination is done by the APS's or on the load-balancer.

Our concerns are most about security, availability and of course performance.

Thank you :)

2 Answers 2

0

Not that you don't also want to harden the server deployment itself, but I would definitely separate the tls offload and application transport/protocol security functionality from your servers and move to a proxy. Let the server be a server and put your security and infrastructure needs in front of that. You can roll your own with NGINX open source or level up with NGINX App Protect. Solution details here.

Full disclosure: I work for F5. If you want more insights on NGINX App Protect, we have a lot of articles in the DevCentral community for your research.

1
  • Thank you for your thoughts. I'll guess I will use the loadbalancer only for loadbalancing and keep the WAF on the APS.
    – louis12356
    Apr 27, 2021 at 21:30
0

I would agree, separating would be a much better approach. This enables traffic to be blocked before it hits the servers. It also decouples functionality and enables the WAF to be upgraded without impacting your servers. Metrics on blocks etc can also be collated in one place giving a clearer picture.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .