topic Re: no SSL inside fire wall in Application Development and Automation Discussions

no SSL inside fire wall

Former Member — Sun, 17 Jul 2011 03:02:00 GMT

We have a network as follows:

Internet --- apache ---firewall --- webdispatcher -- EP-- (ECC, BI, ...etc.)

1) We configure the SSL in that way so that all certificates (inbound) will be terminated at the webdispatcher.

And inside the firewall there is no more any SSL measurement OR any other alike secured links.

Is this design safe enough?

2) The info outbound will use the same SSL from webdispatcher above?

Thanks a lot!

Re: no SSL inside fire wall

mvoros — Mon, 18 Jul 2011 23:55:08 GMT

Hi,

1) depends on your requirements. For example PCI DSS requires that credit card number is always encrypted during transmission. Your set up is not enough to comply with PCI DSS but it might be OK for your environment.

2) I am not sure what you mean by this question but if you are asking about outbound SSL connections from your system then they are not related to web dispatcher.

Cheers

Re: no SSL inside fire wall

Former Member — Tue, 19 Jul 2011 10:19:07 GMT

Thanks for your help.

1) Could you direct me to some blogs about PCI DSS configuration in SAP systems?

2) If outbound message does not go thru webdispatcher, what route it takes?

Thanks again!

Re: no SSL inside fire wall

mvoros — Tue, 19 Jul 2011 10:42:13 GMT

PCI DSS stands for Payment Card Industry Data Security Standard. They have a website where you can find all requirements but it's s bit more complicated. There are some books as well. You can find some articles here on SDN about PCI DSS but they usually address just encryption of credit card details. I am not sure if PCI DSS is relevant for you environment.

Web dispatcher is just reverse proxy. So client connects to web dispatcher and web dispatcher connects to back end system on behalf of user. The outbound connections don't go through web dispatcher. They directly connect to target system.

Cheers

Re: no SSL inside fire wall

Former Member — Tue, 19 Jul 2011 21:34:53 GMT

If you use tokenization and the webdispatcher is a part of the same (hardened) security zone as the SAP server systems, then you should be fine to terminate ssl at the dispatcher.

You should plan this in advance as retro-fitting is expensive (in performance and hardware terms).

Cheers,

Julius