6:1 Firewall Consolidation Changes Face of Security Availability for Worldwide Content Provider

Looking for information about anatomy, physiology, and the mechanics of human movement? You’ll find it at Human Kinetics (HK), an online publisher that provides print, online, and multimedia materials related to kinesiology. Catering to a broad audience, including athletes, coaches, students, educators, physical fitness professionals, and nutritionists, HK’s mission is to help people everywhere lead healthy, active lives through physical activity.

Along with its own e-commerce website, HK hosts nearly 70 related educational and storefront sites. Together, the sites get a million unique visits a month. That’s an impressive feat for a company of about 300 employees. “We’re not a Fortune 500 company with unlimited funds, so when it comes to IT, ‘doing more with less’ isn’t a cliché for us, it’s a reality,” says Stuart Lyons, network security engineer at HK.

The company’s IT infrastructure has evolved somewhat sporadically in response to a 75 percent increase in traffic volume in the last 3 years and a corresponding 300 percent increase in bandwidth needs. Over time, HK had added firewalls in various locations—at the network edge, in front of web and application servers, and in the company’s core network to protect internal resources. By 2013, it was managing 12 separate firewall solutions, which were increasingly difficult to maintain and troubleshoot. Worse yet, the firewalls were still failing under the load.

As is the case for many companies, a handful of HK’s applications launch multiple connections per user session, which significantly increases traffic load. Each firewall could only handle a few hundred thousand concurrent connections per second. When those limits were exceeded, users would get dropped and whatever data they had entered—shopping cart items, for example—would be lost. In reality, HK needed to be able to handle millions of concurrent connections per second.

Since the connection-heavy apps were not going away anytime soon and traffic volume was expected to continue rising, there was no end in sight to HK’s firewall dilemma. “Continuing to segment our network and add more firewalls wasn’t a workable solution,” says Lyons. “We needed to take a completely different approach.”

Alongside these third-party layer 4 network firewalls, HK had been using BIG-IP Local Traffic Manager (LTM) and BIG-IP Application Security Manager (ASM), a layer 7 web application firewall. BIG-IP LTM provided intelligent traffic management while BIG-IP ASM protected HK’s primary website from layer 7 DDoS attacks. It also ensured HK’s compliance with Payment Card Industry Data Security Standard (PCI DSS) requirements.

In 2013, HK contacted F5 about refreshing its existing BIG-IP devices and learned about Synthesis, F5’s architectural vision for providing layer 4–7 services for any application in any environment. Synthesis included a flexible licensing model, Good-Better-Best, which makes BIG-IP modules available in bundles at considerable cost savings over individual module prices.

“Best” licensing would give HK access to all BIG-IP modules, among them, BIG-IP Advanced Firewall Manager (AFM), a layer 4 firewall that aligns firewall policies with applications (rather than devices) and enables centralized firewall policy management. “We had heard that you could use BIG-IP devices as a network firewall, but we thought it involved a lot of custom coding,” says Lyons. “When we realized it was a BIG-IP module we could turn on just by purchasing Best licensing, we were definitely interested.”

HK tested a lab edition of BIG-IP AFM and was amazed how easy it was to configure and administer. “It was clear right away that BIG-IP AFM could do everything our existing firewalls were doing and more—and all from a single location,” says Lyons.

HK decided to upgrade its existing BIG-IP devices and chose to purchase Best licensing along with the new hardware. A big factor in HK’s decision was the single unified platform that BIG-IP provides. The solution would not only solve HK’s immediate firewall woes, it would give HK other security capabilities it needed, such as identity and access management through BIG-IP Access Policy Manager. “We also needed to refresh our SSL VPN solution as well, so with Best licensing, it became really obvious that the solution needed to be F5.”