AnsweredAssumed Answered

Publish Self-Service Portal via WAF (Sophos UTM)

Question asked by Alexander Kromat on Nov 6, 2019
Latest reply on Nov 12, 2019 by Alexander Kromat

Like • Show 0 Likes0
Comment • 6

Hi,
I'm trying to publish the RSA SecureID self-service portal via a Sophos UTM firewall using the Web Applications Firewall (WAF).
Basically it works too. But individual files are not delivered by the web server. These are CSS and JS files. Publishing via NAT is not an option for me.
I've tried that it ends up on the appliance itself or on the web tier.
Has anyone got an idea? Or does it help to update to a newer version of the RSA server? 8.3 and 8.4 would be possible.
I only found instructions for very old RSA versions with WAF on the internet and it was easy there.
Alex

Steven Spicer

Nov 7, 2019 8:17 AM

Correct Answer

Sorry to say, but this appears to require more hands-on investigation than can be provided in this forum. You should open a case with RSA Support; you can do this online at RSA Customer Support or by calling the support line +1 800 995 5095.

See the reply in context

No one else had this question

Outcomes

6 Replies

Erica Chalfin Nov 6, 2019 8:44 AM
Mark Correct
Correct Answer
Alexander Kromat,

I've moved your question to the RSA SecurID Access space where it will be seen by the product's support engineers, other customers and partners. Please bookmark this page and use it when you have product-specific questions.

Alternatively, from the RSA Customer Support page, click on Ask A Question on the blue navigation bar and choose Ask A Product Related Question. From there, scroll to RSA SecurID Access and click Ask A Question. That way your question will appear in the correct space.

Regards,
Erica
Like • Show 0 Likes0
Actions
Steven Spicer Nov 6, 2019 9:50 AM
Mark Correct
Correct Answer
It's hard to comment without knowing more about your current system, but I have a question and two observations:
1. You mention the Self Service Portal. Are you using the SecurID Access Prime Self Service Portal (SSP), or did you mean the Self Service Console that comes with Authentication Manager? There's a difference.
2. You should definitely be looking into upgrading to AM8.4 if you are still on 8.2 or earlier; there have been many feature, performance and security enhancements and fixes. You may also be running an out-of-support version.
3. It sounds like you are not using the webtiers to securely expose the Self Service Console. Why not? (okay, that's two questions) The webtier is designed to safely sit in a DMZ (or equivalent) behind firewalls and/or load balancers and offload much of the self service session processing from the Primary, as well as provide Dynamic Seed Provisioning capabilities to securely deliver soft token seeds into end user devices via the internet.
Like • Show 1 Like1
Actions
- Alexander Kromat @ Steven Spicer on Nov 6, 2019 10:04 AM
  Mark Correct
  Correct Answer
  Hi,
  i try the Self-Service Console from the Authentication Manager and Web Tier. With same effect.
  I do not want to NAT Port 443 from external to my Web Tier. This works but the Port 443 is still used for another service. Thats why i want to use WAF and Host-Header selection and URL hardening.
  After some additional test it seems to be an problem with the extJS Library used in the portal. All other Links works fine.
  
  /console-selfservice/framework/js/extjs/4.0.2a/ext-all.js
  
  All modules after that path including extjs are not working, except when connecting directly to the portal. All Files are there.
  
  Perhaps an problem with modsecurity.
  
  Alex
  Like • Show 0 Likes0
  Actions
  - Alexander Kromat @ Alexander Kromat on Nov 7, 2019 7:39 AM
    Mark Correct
    Correct Answer
    Hi,
    updated today to AM 8.4 Patch 7 with same problem.
    Any ideas?
    Like • Show 0 Likes0
    Actions
    - Steven Spicer @ Alexander Kromat on Nov 7, 2019 8:17 AM
      Unmark Correct
      Correct Answer
      Sorry to say, but this appears to require more hands-on investigation than can be provided in this forum. You should open a case with RSA Support; you can do this online at RSA Customer Support or by calling the support line +1 800 995 5095.
      Like • Show 1 Like1
      Actions
      - Alexander Kromat @ Steven Spicer on Nov 12, 2019 5:25 AM
        Mark Correct
        Correct Answer
        Ok i open an case.
        Like • Show 0 Likes0
        Actions

Publish Self-Service Portal via WAF (Sophos UTM)

Outcomes

Related Content

Recommended Content