- Support of Business SLAs in the Enterprise
- Extranet Support in the Enterprise Environment
- SLA Support in the ISP Environment
- VPN Support in the ISP Environment
- SLA Support in the ASP Environment
- Access Control Support in the ASP Environment
Extranet Support in the Enterprise Environment
In order to illustrate the support of extranets in enterprise environments, we will look at the example of the soft drink bottling company introduced in the previous chapter. The bottling company needs to procure various types of containers and other materials. It plans to do so by means of a bidding server that runs an application to manage the bids received for any specific component, such as containers. The bidding server will be placed so that it is accessible to the suppliers contracted by the company over the Internet. However, for security purposes, the bidding server must be accessible only to a selected subset of suppliers through the Internet.
The following two sections discuss how such an extranet can be supported and established using the network-level mechanisms of IKE, as well as SSL. You should keep in mind that although we are focusing on network-level mechanisms, any extranet needs to put in place application-level security mechanisms to ensure that suppliers are accessing only data relevant to their needs. For example, a metal can supplier doesn't need access to information regarding bids for distilled water supplies.
Extranet Support Using IKE/IPsec
One of the ways in which an extranet can be supported is by using IKE along with IPsec over the Internet. The manner in which this environment will be used in shown in Figure 4.2. The bottling company allows a portion of its intranet to be accessible to the suppliers via the Internet. This is shown as the Company Extranet LAN, which is connected to the Internet by means of Firewall D. The rest of the company's intranet is protected from access by supplier companies by means of Firewall Y. The intranet may also have direct connectivity to the Internet by going through Firewall D or Firewall Y. The bidding server will be placed on a machine in the extranet, which is protected by Firewalls D and Y.
){kind=link}
Figure 4.2
Hypothetical Extranet of a Bottling Company
The applications that act as clients to the bidding server will be located in an environment similar to the supplier companies' intranet. The figure shows two such suppliers. Because the suppliers might not trust the bottling companies, they are likely to place the client software on a machine in the extranet, which is protected by two firewalls. For Supplier A, Firewall A protects access to the bidding client software from unauthorized access over the Internet. Similarly, Firewall X protects the supplier's intranet from the bidding client software, which might not be fully trusted by the supplier.
The communication between Supplier A and the bottling company can be protected by means of an IPsec tunnel between Firewalls A and D. Similarly, the firewall between supplier B and the bottling company can be protected by means of an IPsec tunnel between firewalls B and D. Other alternatives are also possible. For example, you could have the IPsec tunnels established between the machines running the bidding client software and Firewall D, or directly between the machine running the bidding client software and the one running the bidding server software. In the latter mode, ESP or AH secure communication can be established using the transport mode of IPsec. In the other configurations, the tunnel mode of IPsec needs to be used.
Extranet Support Using SSL
Instead of using IPsec for securing communication between the bidding client and bidding server, you can opt to use SSL to secure the communication. When using SSL, you have essentially the same set of firewalls that protects the different segments of the supplier and the bottling company's network. However, firewalls A, B, and D need not support IKE or IPsec protocols. These can be normal packet-filtering firewalls, with security and authentication handled by means of SSL running between the bidding client and bidding server applications.
The configuration of the different firewalls when using SSL would be similar to using IPsec in transport mode between the machines running the bidding client and bidding server applications. The only difference would be that the applications would have to be modified to explicitly invoke SSL calls.