Kemp Zero Trust Access
Gateway
Quick Start GuideKemp Zero Trust Access Gateway

Overview
The Kemp Zero Trust Access Gateway (ZTAG) delivers a simple, flexible, and secure solution for providing
the necessary access for users and applications to access backend systems while greatly reducing theexposure to today’s threats. The Zero Trust Access Gateway architecture leverages the customer’s existing
Kemp load balancers to deliver this security model.
The Kemp Zero Trust Access Gateway delivers secure publishing of workloads using the following attributes:•••••

AuthenticationGroup Membership
Location
HTTP Header
PathHow it works
The Kemp Zero Trust Access Gateway provides administrators with a policy builder to implement granular
least privileged access to resources published through the load balancer. A configuration file is used toclearly define the application as well as the access policy rules. This configuration file is called by a scriptthat allows the administrator to choose different options during each run dependent on the use case being
addressed. Example XML configuration files are provided to assist with the configuration of policies for eachuse case.

Supported Use Cases
The following are the supported use cases for Zero Trust Access Gateway while additional variations arebeing developed and released.
Source IP/Method/Path – This security policy although developed for object storage solutions is not limited
for this workload. The traffic must match all three attributes to be permitted access to the publishedsystem.
Who – The source IP Address of the requestor.
What – The HTTP Method (GET, PUT, DELETE, etc.) being passed to the published system.
Where – The path of the object being requested or written, defined using regular expression (regex)
for flexible implementations.
Authentication Header/Method/SourceIP– This security policy is also developed for object storage solutions
but can be applied to other workloads. The Content Rules for this use case are as follows.
Who – The Authentication Header within the HTTP traffic.
What – The HTTP Method being passed to the published system.
Where – This is Source IP address from where the traffic originated.

kemp.ax

Copyright 2002-2019 Kemp Technologies
All Rights Reserved.

Kemp Zero Trust Access Gateway

SteeringGroup/Path/SourceIP– This security policy is designed for any application that performs preauthentication on the Kemp Load Balancer. This utilizes the Kemp Edge Security Pack feature to determine
a user’s group membership in combination with the client’s source IP address and the path within theapplication they request.
Who – Group membership. This is an attribute that looks at the Active Directory group a user is amember of and directs them to a specific element of the published application.
What – The path within the published application the user is trying to access. By defining this using
regular expressions (regex), an application can be segmented to suit many scenarios
Where – This is Source IP address from where the traffic originated from.
Trusted/ Untrusted Zone– This security policy also requires Kemp Edge Security Pack but determines thetype of authentication that is required for a user based on group and location. Should the traffic match theattributes for a Trusted zone, the user is presented with a simple form to authenticate to the application,
but should the traffic be identified as Untrusted, the user will be required to provide multi-factor
authentication to gain access.
Who – Permitted Group. This is a Kemp specific attribute that looks at the Active Directory group auser is a member of and permits or denies access dependent on their group membership.
Where – This is Source IP address from where the traffic originated from.

Getting Started
Pre-Requisites
The Zero Trust Access Gateway does not require the user to have in-depth knowledge with Kemp products
or PowerShell but some familiarity for each is recommended.
The components that make up the Kemp Zero Trust Access Gateway:••••

Kemp LoadMaster or ECS Connection Manager
Kemp Load Balancer PowerShell Module
Zero Trust Policy Builder PowerShell Script
Zero Trust Policy Builder Configuration File (XML)Import Kemp PowerShell Module1.

Download the Kemp PowerShell Module
The latest Kemp PowerShell Module can be found on the Support Website.
https://support.kemptechnologies.com/hc/en-us/categories/200141477-Downloads

2.

Import the Kemp PowerShell Module –kemp.ax

Copyright 2002-2019 Kemp Technologies
All Rights Reserved.

Kemp Zero Trust Access Gatewaya) Copy the Kemp.LoadBalancer.Powershell folder to the relevant folder.
b) Install the module in a folder that is available in PSModulePath ($Env:PSModulePath).
c) Import the module to start using it:
Import-Module Kemp.LoadBalancer.Powershell

For the PowerShell commands to work, the API interface must be enabled on theLoadMaster. To enable it using the Web User Interface (WUI), go to Certificates & Security >Remote Access and select Enable API Interface

Download the Kemp Zero Trust Access Gateway Package
The latest Kemp ZTAG Package can be found on the Support Website.
https://support.kemptechnologies.com/hc/en-us/categories/200141477-Downloads
Unzip the ZTAG Package.
The package contains the following files:•••••

ZTAG-Policy-Builder.ps1
Config_AuthHeader.xml
Config_SourceIP.xml
Config_SteeringGroup.xml
Config_Trusted_Zones.xml

Modify Configuration File for desired use case
The Zero Trust Policy Builder currently supports four (4) different use cases. Each is defined within a sample
configuration XML file. These configuration files determine the state of the environment which is being
secured.

It is recommended that Notepad++ or some other XML aware application is used whenworking with the ZTAG configuration files
Open the desired sample configuration file. The XML files contain similar sections for the configuration ofthe Virtual Service that will be used to publish and secure the application/workload. Policy specific sections
will be unique based on the use case.

1. Modify the LoadMaster connection settings for the LoadMaster or ECS Connection Manager:• The LoadMaster or ECS Connection Manager IP Address
kemp.ax

Copyright 2002-2019 Kemp Technologies
All Rights Reserved.

Kemp Zero Trust Access Gateway•The LoadMaster or ECS Connection Manager TCP Port

2. Modify the Virtual Service configuration with settings based on workload requirements.
• A Nickname (friendly name) to identify the workload being published• A Virtual IP Address to publish the workload• A Scheduling Method on how the distribution of the traffic to back-end systems shouldoccur.
▪ rr = round robin▪ wrr = weighted round robin▪ lc = least connection▪ wlc = weighted least connection▪ fixed = fixed weighting▪ adaptive = resource based (adaptive)▪ sh = source IP hash▪ dl = weighted response time
▪ sdn-adaptive = resource based (SDN adaptive)▪ uhash = URL hash
• Select whether SSL/TLS Acceleration should be enabled on the Virtual Service.
▪ Y▪ N
Optional – If a certificate is present on the LoadMaster/ ECS Connection Manager a prompt will beprovided to select which certificate should be used in the configuration. A certificate can beuploaded and applied by entering the following parameters• Path/ location to the certificate file (PFX)• A friendly name or identifier for the certificate• The passphrase for importing the certificate

3. Modify the Real Server configuration with settings based on workload requirements.
Real Server Check Method▪ https▪ http▪ tcpkemp.ax

Copyright 2002-2019 Kemp Technologies
All Rights Reserved.

Kemp Zero Trust Access Gateway

4. Modify the Real Server list with IP Address or FQDN of the back-end systems being published. Lines
can be removed or added based on the number of Real Servers in the environment.

5. SourceIP/Method/Path Only - The SourceIP/Method/Path use case identifies where the traffic
originates from based on IP Address. This section defines the networks and description for each
within an environment.
• Source IP Address using Regular Expression (RegEx) to identify the networks in theenvironment.
• Description (friendly name) of the networks in the environment.

6. SourceIP/Method/Path Only - The policy section is where the security settings are configured. Lines
can be added or removed depending on the number of rules that should be applied in the policy.
• Source IP Address to apply the security policy to.
• The method that should be permitted for the defined path/ bucket.
▪ GET
▪ PUT
▪ DELETE▪ POST• The path or bucket to apply the security policy to.

Any Source IP Addresses that are applied here must be identified in the Identify_Network section for
the SourceIP use case abovekemp.ax

Copyright 2002-2019 Kemp Technologies
All Rights Reserved.

Kemp Zero Trust Access Gateway

7. AuthHeader/Method/ SourceIP Only - The AuthHeader/Method/SourceIP use case identifies who isaccessing the workload with the user account that appears in the Authentication Header. Thissection defines the user accounts or Object IDs and description for each within an environment.
• Username to identify the account or object ID in the environment.
• Description (friendly name) of the user account in the environment.

8. AuthHeader/Method/ SourceIP Only - The policy section is where the security settings areconfigured. Lines can be added or removed depending on the number of rules that should beapplied in the policy.
• Username to apply the security policy to.
• The method that should be permitted for the defined path/ bucket.
▪ GET
▪ PUT
▪ DELETE▪ POST• The source IP Address as to where the traffic originates from using Regular Expression(RegEx).

Any Usernames that are applied here must be identified in the Identify_Users section for theSteeringGroup use case above

9. SteeringGroup/SourceIP/Path Only -The SteeringGroup/SourceIP/Path use case identifies who isaccessing the workload with the Active Directory Group they are a member of. This section defines
the Active Directory Groups and description for each within an environment.
• Active Directory Group Names used to secure the environment.
kemp.ax

Copyright 2002-2019 Kemp Technologies
All Rights Reserved.

Kemp Zero Trust Access Gateway•Description (friendly name) of the AD Groups in the environment.

If using the Steering Group Use Case, the Edge Security Pack Single Sign On domainmust be configured prior to running the ZTAG Policy Builder

10. SteeringGroup/SourceIP/Path Only - The policy section is where the security settings are configured.
Lines can be added or removed depending on the number of rules that should be applied in thepolicy.
• Username to apply the security policy to.
• The source IP Address as to where the traffic originates from using Regular Expression(RegEx)• The path of the application that the AD group should have access to.

Any Groups that are applied here must be identified in the Identify_Groups section for theSteeringGroup use case above

11. Trusted/Un-Trusted Only - The Trusted Zone section identifies the known networks in theenvironment. These are the networks where Multi Factor Authentication will not be required.
• The Source IP will be the network address using Regular Expression (RegEx) that clients will
be connecting from. Lines can be added or removed depending on the number of known
networks in the environment.

kemp.ax

Copyright 2002-2019 Kemp Technologies
All Rights Reserved.

Kemp Zero Trust Access Gateway

12. Trusted/Un-Trusted Only - The Permitted Groups Trusted Zone section is where the Active Directorygroups are defined. Members of these groups should be granted access to the application if they areconnecting to the application from a network that is listed in the Trusted Zones section above. Lines
can be added or removed depending on the number of groups that need access to the application.
• Group – Active Directory group name

If using the Trusted/ Un-Trusted Use Case, the Edge Security Pack Single Sign On domain for
the trusted zone must be configured prior to running the ZTAG Policy Builder

13. Trusted/Un-Trusted Only - The Permitted Groups Un-Trusted Zone section is where the Active
Directory groups are defined. Members of these groups should be granted access to the application
if they are connecting to the application from a network that is NOT listed in the Trusted Zone
section above. If the same group should have access regardless of network they are connected to,
the group names should be listed in both sections. Lines can be added or removed depending on thenumber of groups that need access to the application.
▪ Group – Active Directory group name

If using the Trusted/ Un-Trusted Use Case, the Edge Security Pack Single Sign On domain for
the un-trusted zone must be configured prior to running the ZTAG Policy Builder.

14. Optional - During each run of the Zero Trust Policy Builder, the option to take a backup before anychanges are applied is presented. These options are used to define the name and where the backup
should be stored. A date and time stamp will also be included in the backup file name.
• File Path – Ensure the proper permissions are applied to the folder.
• Backup file name – Used to identify the backup being taken

kemp.ax

Copyright 2002-2019 Kemp Technologies
All Rights Reserved.

Kemp Zero Trust Access Gateway

15. Logging is generated for each run of the Zero Trust Policy Builder. These settings will provide thelocation for the log files and how much of the disk can be utilized to store files.
• File Path – Ensure the proper permissions are applied to the folder.
• Max Log Size – The maximum size of each of the log files.
Max Log Rollovers – The maximum number of log file rollovers to allow. Setting of 2 rollover files
and 500KB maximum size will allow for 1000KB of storage to be used on the system running the ZeroTrust Policy Builder.

Run the Zero Trust Policy Builder script
There are two approaches for running the Zero Trust Policy Builder PowerShell script. The PowerShellconsole and the PowerShell Integrated Scripting Environment (ISE). The interaction with the Zero Trust
Policy Builder will be different between these two approaches but the results will be identical. This
document will focus on using PowerShell ISE since it provides more user-friendly prompts than thePowerShell Console.

The Zero Trust Policy Builder is a fixed script that should not be modified under any
circumstances.
Although some interaction that is presented are common across the different use cases, there are someunique for each.

Deploy a new workload
1. Open the ZTAG-Policy-Builder.ps1 script using PowerShell ISE.

2. Click the Green Arrow to run the ZTAG Policy Builder script.

3. Click OK on the Welcome Message.

kemp.ax

Copyright 2002-2019 Kemp Technologies
All Rights Reserved.

Kemp Zero Trust Access Gateway

4. Enter the path to the configuration file that should be used and Enter

5. Enter the credentials to authenticate to the LoadMaster or ECS Connection Manager.

6. Select Create New Virtual Service

7. Choose whether to perform a backup prior to making any updates on the LoadMaster/ ECS
Connection Manager.

8. If enable TLS was set to “Y” in the configuration file and no parameters were provided to add a newcertificate, a prompt to select an existing certificate is provided.

9. (Steering Group Use Case Only) – A prompt is presented to select an existing SSO domain to use to
pre-authenticate users.

kemp.ax

Copyright 2002-2019 Kemp Technologies
All Rights Reserved.

Kemp Zero Trust Access Gateway

10. (Trusted/UnTrusted Zone Use Case Only) – Select the SSO domain to use for known networks within
the environment.

11. (Trusted/UnTrusted Zone Use Case Only) – Select the SSO domain to use for all other networks that
do not exist in the environment.

12. The script steps will be presented as the configuration takes place.

13. A confirmation that the script ran successfully will be presented at completion.

Update an existing workload

1. Run the script and accept the welcome message

2. Select Update Existing Virtual Service

kemp.ax

Copyright 2002-2019 Kemp Technologies
All Rights Reserved.

Kemp Zero Trust Access Gateway

3. Choose whether to perform a backup prior to making any updates on the LoadMaster/ ECS
Connection Manager.

4. If enable TLS was set to “Y” in the configuration file and no parameters were provided to add a newcertificate, a prompt to select an existing certificate is provided.

5. Select the Virtual Service you would like updated.
6. The remaining prompts will be identical to the steps outlined above.

kemp.ax

Copyright 2002-2019 Kemp Technologies
All Rights Reserved.