Product Documentation

Analytics: SSL Insight

Dec 30, 2016

SSL Insight provides visibility into secure web transactions (HTTPS) and allows IT administrators to monitor all the secure web applications being served by the NetScaler ADC by providing integrated and real-time and historic monitoring of secure web transactions. With this visibility the administrator can assess following:

  • Determine Configuration Change Impact on Customer Usage: The administrator can understand the impact on clients for making a configuration change like turning off SSLv3 or removing a cipher like RC4-MD5. This can be done by assessing the historic transaction data on this protocol and cipher.
  • Quantify client performance: Administrator can understand the impact on Application Response Time based on the SSL ciphers/protocol used or the certificates negotiated.
  • Application Security: Assess if any of the application have transactions running on low security protocols, ciphers or weak key strength.

When SSL Analytics is enabled on a NetScaler instance, SSL statistics are recorded and logged for every SSL transaction. The statistics show the details of the SSL flow. Also, every successful connection is logged and displayed by NetScaler MAS Analytics.

Note

Information about SSL connections that are not successful is not logged or displayed by NetScaler MAS Analytics.

SSL Insight provides the following critical information, which is displayed by NetScaler MAS Analytics:

  • SSL Protocol version negotiated 
  • Cipher negotiated, and the cipher strength
  • Signature Hash algorithm of the certificate used
  • Certificate Type & Size

Note

For successful SSL connections, SSL appflow logging happens at the end of every transaction.

Prerequisites

  • The NetScaler instance on which you intend to configure SSL Insight must be running a NetScaler software release no earlier than 11.1 build 51.21.
  • The NetScaler MAS version should be no earlier than the NetScaler software version. 

Configuring SSL Insight

SSL Insight Metrics are included in Web Insight reports if you enable the following elements:

  • Enable AppFlow for Web Insight on each NetScaler instance. 
  • Enable ULFD mode on each NetScaler instances. 
  • Enable required AppFlow parameters on each NetScaler instance. 

Enabling the AppFlow Feature

Note

You can enable the Appflow feature either from NetScaler MAS or from each NetScaler instance.

To enable the AppFlow feature from NetScaler MAS

  1. In a web browser, type the IP address of the NetScaler MAS virtual appliance (for example, http://192.168.100.1).
  2. In User Name and Password, enter the administrator credentials.
  3. Navigate to Infrastructure > Instances, and select the NetScaler instance on which you want to enable analytics.
  4. From the Action drop-down list, select Enable/Disable Insight.
  5. Select the virtual servers, and click Enable AppFlow.
  6. In the Enable AppFlow field, type true, and select Web Insight.
  7. Repeat steps 3 through 6 on each NetScaler instance.
  8. Click OK.                      
localized image

Note

You cannot enable data collection on a virtual server if the operational state of the virtual server is other than UP.

To enable the AppFlow feature from the NetScaler command line

On a NetScaler instance, at the command prompt, type:

enable ns feature AppFlow 

To enable the AppFlow feature by using the NetScaler GUI

In a NetScaler instance's GUI, navigate to Configuration > System > Settings, click Configure Advanced Features, and select AppFlow.

Enabling ULFD Mode

After you enable ULFD mode on the NetScaler instances on which the virtual servers are configured, the ULFD server streams the analytics data from the NetScaler instances to NetScaler MAS.

To enable ULFD mode by using the NetScaler command line

1. On the NetScaler instance, at the command prompt, type:

enable mode ulfd

2. Add the NetScaler MAS IP address as the ULFD server on the NetScaler instance by entering the following command:

add ulfd server <your_MAS_IP Address>

Enablinge SSL Insight Parameters

On each NetScaler instance, you have to enable some HTTP parameters to display SSL Insight records in NetScaler MAS. 

To enable SSL Insight parameters from the NetScaler command line

At the command prompt, type:

set appflow param -httpDomain ENABLED -httpHost ENABLED -httpMethod ENABLED -httpUrl ENABLED -httpUserAgent ENABLED -httpContentType ENABLED 

To enable SSL Insight parameters from the NetScaler configuration utility

  1. Navigate to Configuration > System > AppFlow, and click Change AppFlowSettings.
  2. Select the following check boxes: HTTP Domain, HTTP Host, HTTP Method, HTTP URL, HTTP User-Agent, HTTP Content-Type.  
  3. Click OK.
localized image

Viewing the SSL Insight Metrics

SSL Insight metrics in NetScaler MAS provide a detailed view of the performance of the SSL transactions served by the NetScaler instances. You can view the SSL Insight metrics at the client, server, or application level. With the help of these metrics, you can analyze and optimize your NetScaler HTTPS settings and SSL-certificate settings, and track performance issues. 

To monitor SSL Insight Metrics in NetScaler MAS

  1. On the Analytics tab, navigate to Web Insight and click the Client, Server, or Application node to display the metrics about clients, the server, or the applications, respectively.
  2. In the top-left pane, from the drop-down list, select the time frame whose metrics you want to display. You can customize the time frame by using the time-frame slider. Click Go.
  3. The SSL Insight metrics appear as pie charts, which you can click for more details.

Note

The pie charts display the metrics of all the applications, clients or servers.

localized image

4. To display details for a specific application, client, or server, click the corresponding value on the bar graph.

localized image

SSL Insight Use Case

The following use case describes how you can use SSL Insight to assess the usage of various SSL Parameters in applications, clients and servers, and improve security measures.

Obtain an Overview of the SSL Transactions of Applications, Clients, or Servers

In this use case, you have a set of applications that are using SSL transactions (HTTPS) for communication, and you have configured NetScaler MAS to monitor the SSL components. You might need to frequently review the applications so that you can focus first on the applications that need the most attention. The SSL insight dashboard provides a summary of various SSL parameters used by your applications over a time period of your choosing, and for a selected NetScaler device. They are:

  • SSL Certificates
  • SSL Protocols
  • SSL Cipher Negotiated
  • SSL Key Strength
localized image

In the following example, you can see list of clients (identified by their IP addresses) and the SSL hits per client. Also, at the right, you can view the SSL Parameters for all the clients. 

localized image

To display SSL details for a client, select the client on the bar graph or in the table below the graph. In the following example, the selected client's transactions use an SHA1 SSL certificate and four major protocols: TSLv1.2, TSLv1.1, TSLv1, and SSLv3. You can also see that ciphers of various strengths were negotiated. The color code indicates the strength of the SSL protocol, which gives you information about weak ciphers and strong ciphers.

localized image