Front cover - IBM Redbooks

4.1.4 Proxy servers
Application proxies
Application-level proxies were developed to provide more sophisticated levels of
security. Application-level proxies stand between two networks and relay data
between clients on one network to servers in the other. Instead of a direct
connection between internal and external networks, application-level proxies
typically serve as a middleman for Internet services. The proxy intercepts all
traffic and relays packets of data back and forth between the client application
and the server-based application. Application-level proxy technology can serve
important security roles in the infrastructure. Application proxies fall into two
categories: reverse proxies for inbound connections, and forward proxies for
outbound connections. We discuss these two types of application proxies later in
this section.
Proxy servers are somewhat unique in that they perform network separation
functions like a firewall, yet they might also behave like a server from a user’s
point of view. As previously mentioned, a proxy can perform at either a session
level (layer 4) or an application level (layer 7). Some firewall products provide
session-level proxy capabilities, but as a general rule, application-level proxies
are dedicated systems. Because application-layer proxies inspect all packets
including the application data “payload,” the throughput performance of an
application proxy will be considerably less than a packet or stateful packet
filtering router.
Proxies can work in different directions, although they are usually dedicated to a
single client-server data flow direction. In order to make sense of the proxy
nomenclature, remember that it is based on the internal network as the reference
point of view.
Reverse proxies
Reverse proxies were developed to meet a need to provide access from
external networks (the Internet) into corporate resources. They facilitate the
elimination of data storage from outer network zones. A multi-zone
architecture is discussed later in this chapter. A reverse proxy basically
handles incoming requests from external clients, then performs the request
against the back-end application server on behalf of the client. The client
never directly connects to the destination service or application.
Forward proxies
Forward proxies were developed to control access from workstations within
the corporate controlled network to services on external networks. Similar to a
reverse proxy, the internal client request goes to the forward proxy, which
then passes the request on to the external service.
Chapter 4. Security components and layers 127