Table of contents

Titel
Table of contents
1. Airlock Secure Access Hub
1.1. Semantic versioning scheme for Airlock Secure Access Hub components
2. About this document
2.1. How information is structured in this manual
2.2. Leveled prerequisites
2.3. Warning tiers in this document
2.4. Additional panel types
2.5. Advanced Lucene searches within this online help
3. About Airlock Gateway
3.1. Airlock Gateway license and sales
3.2. 3rd party software license conditions
3.3. System and hardware requirements
3.3.1. Resource requirements for on-premises installations
3.3.2. Resource requirements for cloud installations
3.3.3. Performance considerations on load and configuration
3.3.4. Hardware configuration recommendations
3.3.5. Supported SSL/TLS versions
3.4. About the Airlock Gateway user interfaces
3.4.1. About the Airlock Gateway admin menu
3.4.2. About the Airlock Gateway Configuration Center
4. Release notes
4.1. New features in Airlock Gateway 8.3
4.2. Actions required when upgrading
4.3. Changelog Airlock Gateway 8.3
5. Getting started
5.1. Prepare the installation media
5.2. Quick installation guide for Airlock Gateway on-premises installation
5.3. Updating Airlock Gateway using the admin menu
5.3.1. Apply an update interactively
5.3.2. Apply an update non-interactively
5.4. NIC setups for cloud and on-premises installations
5.4.1. Public cloud installations
5.4.2. On-premises installations
6. General warnings and recommendations
7. Basic concepts and functional overviews
7.1. Airlock Anomaly Shield
7.1.1. Terms and definitions related to Airlock Anomaly Shield
7.1.2. Architecture overview
7.1.3. Anomaly detection
7.2. Airlock Gateway rewrite engine with URL encryption
7.3. Airlock Gateway Smart Form Protection
7.4. API access control with Airlock Secure Access Hub
7.4.1. Solution overview
7.4.2. Tech-Client management
7.5. Attribute locking in the Configuration Center
7.6. Back-end load balancing and failover
7.6.1. Runtime behavior
7.6.2. Load balancing example cases
7.7. Clustering, load-balancing, and failover scenarios for Airlock Gateway setups
7.8. Cookie handling and cookie types
7.8.1. Environment cookies
7.8.2. Cookie security attributes
7.9. Cross-Site Request Forgery (CSRF) protection
7.10. Dynamic back-end group selection
7.11. Entry path to back-end path settings
7.11.1. Entry path as Directory or Regular expression
7.11.2. Option Enforce trailing slashes
7.12. HTTP/HTML rewriting
7.13. JSON parsing and filtering
7.14. JWKS and JWK selection by filtering
7.14.1. Reference lists of supported JWKS algorithms
7.15. Multitenancy feature
7.15.1. Terms and definitions
7.15.2. Role and rights management for tenant-users
7.15.3. Security considerations
7.15.4. Manage tenant-users
7.15.5. Practical applications and examples
7.16. Rewrite variables
7.17. Rule-based filtering
7.18. Simultaneous administration and configuration merge
7.18.1. How does configuration merge work in general?
7.18.2. When does the merge process fail?
7.18.3. Cancel vs. overwrite a configuration
8. REST API based Airlock Gateway configuration and management interface
9. Configuration Center (web-based GUI)
9.1. Button – Activate
9.2. Menu – Dashboard
9.2.1. Section – Users logged in
9.2.2. Section – System health
9.2.3. Section – Proxy statistics
9.3. Menu – System Setup
9.3.1. Submenu – License
9.3.2. Submenu – Updates
9.3.3. Submenu – Nodes & Interfaces
9.3.4. Submenu – Routes
9.3.5. Submenu – Hosts
9.3.6. Submenu – Network Services
9.3.7. Submenu – Threat Intelligence
9.3.8. Submenu – IP Address Lists
9.3.9. Submenu – System Admin
9.4. Menu – Application Firewall
9.4.1. Submenu – Reverse Proxy
9.4.2. Submenu – Policy Learning
9.4.3. Submenu – Anomaly Shield
9.4.4. Submenu – Geolocation Filter
9.4.5. Submenu – Certificates
9.4.6. Submenu – JWKS Providers
9.4.7. Submenu – Session
9.4.8. Submenu – Default Actions
9.4.9. Submenu – Deny Rules
9.4.10. Submenu – API Security
9.4.11. Submenu – Dynamic IP Blacklist
9.4.12. Submenu – Error Pages
9.5. Menu – Log & Report
9.5.1. Submenu – Log Viewer
9.5.2. Submenu – Reporting
9.5.3. Submenu – Session Viewer
9.5.4. Submenu – System Monitor
9.5.5. Submenu – Settings
9.6. Menu – Configuration
9.6.1. Submenu – Configuration Files
9.6.2. Submenu – Configuration Summary
9.7. Menu – Expert Settings
9.7.1. Submenu – Security Gate / Apache
9.7.2. Submenu – Add-on Modules
10. Configuration examples and guides for general configuration tasks
10.1. Airlock Anomaly Shield configuration
10.1.1. Part 1 – Preconfigure an Airlock Anomaly Shield application
10.1.2. Part 2 – Training and model enforcement
10.1.3. Part 3 – Trigger, pattern and rule configuration
10.1.4. Part 4 – Activate detection and response action (log-only mode)
10.1.5. Part 5 – Analyze and adjust threat handling settings
10.1.6. Optional configuration of Traffic Matchers
10.1.7. Recommendations for assigning mappings to Anomaly Shield applications
10.1.8. Airlock Anomaly Shield logs, tuning and advanced configuration
10.2. Airlock Gateway failover setup for on-premises installations
10.2.1. Setup a failover cluster
10.2.2. Remote activation within an Airlock Gateway failover cluster
10.2.3. Maintaining actions on cluster nodes
10.2.4. Hardware replacement in failover cluster
10.3. Allow rule configuration
10.4. API access control configuration for Airlock IAM and Airlock Gateway
10.4.1. Configure the Airlock IAM API policy service
10.4.2. Configure Tech-Client management in Airlock IAM
10.4.3. Configure API gateway for API key-based access control
10.5. Configure and manage custom HTTP error pages
10.6. Customize Elasticsearch data archiving
10.7. Configuration example cases for URL encryption
10.8. Configure filter rules using regular expression patterns
10.8.1. Regular Expressions basic examples
10.8.2. Regular Expressions advanced examples
10.9. Cookie parsing according to RFC 6265
10.10. Customizing events
10.11. Deny rule configuration
10.11.1. Blocking levels
10.11.2. Blocking and logging
10.11.3. Deny rule exceptions
10.12. How to choose/switch to the best session handling mode
10.13. HTTP compression
10.14. Remote Elasticsearch access with HTTPS
10.15. Syslog forwarding with SSL
10.16. TLS/SSL Certificate creation
10.17. Using the policy learning feature
11. Integration tasks for web applications and 3rd-party software
11.1. Control API
11.1.1. Control API cookie
11.1.2. ICAP control API header
11.1.3. General command syntax
11.1.4. Session authorization
11.1.5. Basic-Auth propagation
11.1.6. NTLM propagation
11.1.7. Session control
11.1.8. Selecting session tracking mode via API
11.1.9. Audit token
11.1.10. Setting HTTP headers
11.1.11. Kerberos user and domain
11.1.12. Session timeout
11.1.13. Authentication workflow
11.1.14. Session variables
11.1.15. Pseudo code
11.1.16. Unconditional control API commands
11.1.17. Summary of syntax rules
11.1.18. Expert Settings
11.2. Using header tokens for session tracking
11.3. Cross-Site Request Forgery (CSRF) protection for SPAs
11.4. ICAP configuration
11.5. Local and remote JWKS Providers configuration
11.6. GraphQL integration
11.7. Let's Encrypt as certificate provider
11.8. Threat Intelligence by Webroot BrightCloud
11.9. Microsoft integration guides
11.9.1. Integration of Microsoft Exchange 2016 / 2019
11.9.2. Publishing Microsoft SharePoint 2016
11.9.3. Publishing Microsoft SharePoint 2019
11.9.4. Publishing Microsoft WebDAV
11.9.5. Kerberos integration
12. Tasks to maintain and improve the operation
12.1. Working with Airlock Anomaly Shield dashboards
12.2. Airlock Gateway failover cluster upgrade with full system installation
12.3. Airlock Gateway Configuration Center access via IAM
12.3.1. Configure Airlock IAM access management using URL parameters (recommended)
12.3.2. Configure IAM access management using cookies (alternative)
12.3.3. Emergency access and troubleshooting
12.4. Automatic configuration backup with SCP
12.5. System backup/restore via the Airlock Gateway admin menu or scripts
12.6. Client connection handling keepalive using the Apache MPM module instead of the Apache HTTP Server
12.7. Configure automatic updates for the geolocation database
12.8. Increasing the Java heap space for Configuration Center Tomcat and the Airlock management agent
12.9. Logs and diagnostics
12.10. List of frequent events
12.10.1. Possible ICAP problem - response time repeatedly too high
12.10.2. Possible back-end problem – response time repeatedly too high
12.10.3. Possible attack - many requests with status code 404
12.10.4. Possible attack - many requests blocked
12.11. SSH login with public/private key authentication
13. Reference documentation
13.1. Airlock Gateway default deny rule groups and request/response actions
13.1.1. Default Deny Rules
13.1.2. Default Request Actions
13.1.3. Default Response Actions
13.2. Reference lists of log messages and events
13.2.1. Log messages
13.2.2. Events
13.3. Administrative roles in Airlock Gateway
14. Expert settings collection
14.1. Regular Expressions advanced examples
14.2. Modification of default Apache SSL/TLS settings
14.3. Deploy Apache mod_status for analysis purposes
15. Troubleshooting and support
15.1. Network traffic tracing using tcpdump and TShark/Wireshark
15.2. Network traffic tracking based on conntrace log messages