Ing. Ondřej Ševeček | GOPAS a.s. | MCM: Directory Services | MVP: Enterprise Security | Certified Ethical Hacker | | |

Web Application Proxy

Threat Management Gateway  Forward HTTP/S proxy  Kerberos SSO authentication  user/group based rules and logging  HTTPS inspection  Reverse HTTP/S proxy  TLS/SSL endpoint  HTTPS inspection  Basic, Forms, TLS certificate, AD FS authentication  Kerberos constrained delegation  Stateful firewall  IP/ICMP/TCP/UDP/GRE/AH/ESP/FTP

Web Application Proxy  Forward HTTP/S proxy  Kerberos SSO authentication  user/group based rules and logging  HTTPS inspection  Reverse HTTP/S proxy  TLS/SSL endpoint  HTTPS inspection  Basic, Forms, TLS certificate, AD FS authentication  Kerberos constrained delegation  Stateful firewall  IP/ICMP/TCP/UDP/GRE/AH/ESP/FTP

HTTP/S Client TMG forward proxy HTTP/S Server TMG Proxy DC HTTP/S Client HTTP/S Client NAT HTTP/S Client

Exchange OWA TMG/WAP reverse proxy Browser HTTP/S Client TMG DC Web CRM Share Point GUI HTTP/S Client NAT TLS Cert

Exchange OWA Perimeter authentication + auth. forwarding Browser HTTP/S Client TMG DC Web CRM Share Point GUI HTTP/S Client NAT

TLS client certificate authentication  TLS session establishes first  Without client certificate no HTTP inside  No password guessing  Certificates mapped to user accounts

Web Application Proxy

Network Access Technologies  VPN  SMB/SQL/LDAP/DCOM sensitive to RTT  Remote Desktop  no clipboard, no file proliferation  limited malware surface  802.1x  WiFi or Ethernet  no encryption, authorization only  DirectAccess  GPO managed IPSec tunnel over IPv6  Web Application Proxy  HTTPS reverse proxy for web applications

RDP VPN Scenario VPN Client VPN Gateway DC FS SQL RADIUS NAT Share Point

RDP DA Scenario DA Client DA Server DC FS SQL RADIUS NAT Share Point

Wks RDP RDP Scenario RDP Client RDP Gateway DC FS SQL RADIUS NAT Share Point Wks

RDP 802.1x WiFi Scenario WiFi Client DC FS SQL RADIUS WiFi AP Share Point

RDP 802.1x Ethernet Scenario Wks DC FS SQL RADIUS Switch Share Point Wks Printer

AD FS Proxy Exchange WAP Scenario Web Browser or GUI client Web Application Proxy DC Web Lync AD FS NAT Share Point

VPN Compared ProtocolTransportClientRRAS Server Server Requirements PPTP TCP 1723 IP GRE MS-DOS and newer NT 4.0 and newer- - L2TP UDP 500, 4500 IP ESP NT 4.0, 98 and newer 2000 and newer IPSec certificate public name Public IP IPSec machine certificate SSTP TCP 443 TLS Vista/2008 and newer 2008 and newer TLS certificate public name - IKEv2 UDP 500, 4500 IP ESP 7/2008 R2 and newer 2008 R2 and newer IPSec certificate public name Public IP IPSec machine certificate

VPN Compared ProtocolTransportClientRRAS Server Server Requirements RD Gateway TCP 443 TLS RDP Client 6.0 and newer 2008 and newer TLS certificate public name - DirectAccess IPSec inside IPv6 inside TCP 443 TLS or Teredo/6-to-4 7/2008 R2 Enteprise IPv6 enabled, GPO 2012 and newer IPSec certificate TLS certificate public name IPSec machine certificate Web Application Proxy HTTPS web browser GUI web client (office) 2012 R2 and newer WAP and AD FS server TLS certificate public name TLS certificate for AD FS public name

Web Application Proxy

AD FS Proxy Names and certificates Web Browser or GUI client Web Application Proxy DC AD FS Share Point NAT

AD FS Proxy Service accounts Web Browser or GUI client Web Application Proxy DC AD FS Share Point sp-intranet-web Network Service svc-adfs Network Service NAT

AD FS Proxy Windows authentication with passwords - overview Web Browser or GUI client Web Application Proxy DC AD FS Share Point Forms Basic POST Cookie NAT Kerberos Exchange

AD FS Proxy Windows authentication with passwords - #1 Web Browser or GUI client Web Application Proxy DC AD FS Share Point Exchange NAT Redirect 307

AD FS Proxy Windows authentication with passwords - #2 Web Browser or GUI client Web Application Proxy DC AD FS Share Point Exchange Forms Basic POST NAT

AD FS Proxy Windows authentication with passwords - #3 Web Browser or GUI client Web Application Proxy DC AD FS Share Point Exchange NAT Claims Redirect 302

AD FS Proxy Windows authentication with passwords - #4 Web Browser or GUI client Web Application Proxy DC AD FS Share Point Exchange NAT Claims Kerberos Cookie

AD FS Proxy Windows authentication with passwords - #5 Web Browser or GUI client Web Application Proxy DC AD FS Share Point Exchange NAT 200 OK Cookie

AD FS Proxy Windows authentication with TLS client certificate Web Browser or GUI client Web Application Proxy DC AD FS Share Point Cookie NAT TLS Client Certificate Kerberos Exchange TLS Client Certificate TCP 49443

AD FS Proxy Claims authentication Web Browser or GUI client Web Application Proxy DC AD FS Share Point Forms Cookie NAT Claims Exchange Basic POST TLS Client Certificate Cookie Claims

Web Application Proxy

Long journey yet?  Basic only with pass-through  deprecated since AD FS 2.0  no Basic fallback (GUI clients)  No selection intranet/extranet  No persistent cookies  always the web page regardless of client (GUI)  AD FS native support since Exchange 2013 SP1  AD FS native support since SharePoint 2010  no WebDAV support  No inspection