© 2014 IBM Corporation

What’s New in DataPower Appliances V7.0

Ozair SheikhSenior Product Manger, DataPower AppliancesIBM

Arif SiddiquiPrincipal Product Manager, DataPower AppliancesIBM

Agenda

• DataPower Quick Overview

• What’s new in DataPower v6.0 & v6.0.1

• What’s new in DataPower v7.0

Introduction to DataPower Gateway Appliances

IBM DataPower Gateway Appliances are the industry-leading Security & Integration gateways that help provide security, control, integration and

optimized access to a full range of Mobile, Web, API, SOA, B2B, & Cloud workloads

Security & Integration Gateway Appliances

• Securely expose enterprise data to external consumers/partners, while optimizing delivery of the workload

• Securely connect apps/services within the enterprise, while optimizing delivery of the workload and providing integration including XML/JSON offload, message validation/filtering, message/transport protocol transformation, traffic control/quota enforcement, SOA governance & management, dynamic routing & intelligent load distribution

• Physical appliance that is purpose-built, tamper-evident with simplified deployment combining superior performance, hardened security, increased ROI and reduced TCO

• Provides high levels of certified Security assurance ‒ e.g. Transport Protocol Security (SSL/TLS), Message Level Security, and Authentication,

Authorization, Audit• Simplified maintenance model

‒ Drop-in appliance form-factor, Secures traffic in minutes, and Push-button flash upgrade process• Over a decade of innovation. 2,000 worldwide installations. 10,000+ physical units sold• Virtual appliance provides deployment flexibility & reduced cost for development and test

environments

IBM DataPower Gateway Appliances

Internet Trusted Domain

Consumer

Application or Service

DMZ

DataPower DataPower

Consumer

Internet Trusted Domain

Consumer

Application or Service

DMZ

DataPower DataPower

Trading partners

DataPower Appliances used across a variety of scenarios

1 Security Gateway (Web Services/Apps/APIs)

2 Intelligent Content Routing & Load Distribution

3 B2B Partner Gateway

4 Internal Security Enforcement

5 Integration

6 Runtime SOA Governance

7 Web Service Management

8 Legacy Integration

Consumer

System Z

• Control‒ Service-level agreements‒ Traffic control‒ Message accounting‒ Content-based routing‒ Governance & management

• Optimization ‒ SSL & TLS offload‒ Hardware accelerated crypto ops‒ XSLT & XQuery acceleration‒ JavaScript & JSONiq acceleration‒ Connection pooling, offload‒ Intelligent load distribution‒ Caching: Local & external (XC10)

• Security‒ OAuth, SAML, XACML, WS-

Security, LTPA, Kerberos, etc‒ Authentication & authorization‒ Security token translation‒ Message & transport protection

• Integration‒ Convert payloads (JSON, XML,

CSV, Cobol, binary, etc)‒ Bridge transports (HTTP, MQ, FTP,

WAS JMS, TIBCO EMS, etc)‒ Database connectivity (DB2, IMS,

Oracle, MS SQL, Sybase)‒ Mainframe integration (IMS

Connect, IMS Callout, CICS, etc)‒ B2B integration (AS1,AS2,AS3,etc)

• Resilience‒ Operation admission control‒ Failure re-routing‒ XML threat protection‒ JSON threat protection‒ Schema validation‒ Messages filtering

Clients

In-the-Clear Request

Malicious Request

Cobol/MQ Appl

Cobol/MQ

Encrypted and Signed Request

Ser

vice

Pro

vide

rs

IBM DataPower Gateway Appliance capabilities

• Data format & language– JavaScript‒ JSON ‒ JSON Schema ‒ JSONiq ‒ REST ‒ SOAP 1.1, 1.2 ‒ WSDL 1.1 ‒ XML 1.0 ‒ XML Schema 1.0 ‒ XPath 1.0 ‒ XPath 2.0 (XQuery only) ‒ XSLT 1.0 ‒ XQuery 1.0

• Security policy enforcement‒ OAuth 2.0 ‒ SAML 1.0, 1.1 and 2.0, SAML Token

Profile, SAML queries ‒ XACML 2.0 ‒ Kerberos, SPNEGO ‒ RADIUS‒ RSA SecurID OTP using RADIUS ‒ LDAP versions 2 and 3 ‒ Lightweight Third-Party Authentication

(LTPA) ‒ Microsoft Active Directory ‒ FIPS 140-2 Level 3 (w/ optional HSM)‒ FIPS 140-2 Level 1 (w/ certified crypto

module) ‒ SAF & IBM RACF® integration with z/OS ‒ Internet Content Adaptation Protocol‒ W3C XML Encryption ‒ W3C XML Signature ‒ S/MIME encryption and digital signature ‒ WS-Security 1.0, 1.1 ‒ WS-I Basic Security Profile 1.0, 1.1 ‒ WS-SecurityPolicy ‒ WS-SecureConversation 1.3

DataPower Gateway: Supported standards & protocols• Transport & connectivity

– HTTP, HTTPS, WebSocket Proxy– FTP, FTPS, SFTP – WebSphere MQ– WebSphere MQ File Transfer Edition

(MQFTE) – TIBCO EMS – WebSphere Java Message Service (JMS) – IBM IMS Connect, & IMS Callout– NFS – AS1, AS2, AS3, ebMS 2.0, CPPA 2.0,

POP, SMTP (XB62) – DB2, Microsoft SQL Server, Oracle,

Sybase, IMS

• Transport Layer Security ‒ SSL versions 2 and 3 ‒ TLS versions 1.0, 1.1, and 1.2

• Public key infrastructure (PKI)‒ RSA, 3DES, DES, AES, SHA, X.509,

CRLs, OCSP ‒ PKCS#1, PKCS#5, PKCS#7, PKCS#8,

PKCS#10, PKCS#12‒ XKMS for integration with Tivoli Security

Policy Manager (TSPM)

• Management‒ Simple Network Management Protocol

(SNMP) ‒ SYSLOG ‒ IPv4, IPv6

• Open File Formats‒ Distributed Management Task Force

(DMTF) Open Virtualization Format (OVF)‒ Virtual Machine Disk Format (VMDK)‒ Virtual Hard Disk (VHD)

Link to DataPower Information Center

• Web services– WS-I Basic Profile 1.0, 1.1 – WS-I Simple SOAP Basic Profile – WS-Policy Framework – WS-Policy 1.2, 1.5 – WS-Trust 1.3 – WS-Addressing – WS-Enumeration – WS-Eventing – WS-Notification – Web Services Distributed Management

(WSDM) – WS-Management – WS-I Attachments Profile – SOAP Attachment Feature 1.2 – SOAP with Attachments (SwA) – Direct Internet Message Encapsulation

(DIME) – Multipurpose Internet Mail Extensions

(MIME) – XML-binary Optimized Packaging (XOP) – Message Transmission Optimization

Mechanism (MTOM) – WS-MediationPolicy (IBM standard) – Universal Description, Discovery, and

Integration (UDDI versions 2 and 3), UDDI version 3 subscription

– WebSphere Service Registry and Repository (WSRR)

DataPower Family

Integration Appliance XI52 High density 2U form, XG45 functionality plus “Any-to-Any” conversion at wire-speed Bridges multiple transport protocols Mainframe integration & enablement Available in Virtual Edition

Service Gateway XG45 Entry-level device, slim footprint (1U) Security gateway (AAA, XML threat, etc) Service level management and monitoring Intelligent load distribution & dynamic routing Lightweight integration functions (optional) Available in Virtual Edition

B2B Appliance XB62 High density 2U form, XI52 functionality plus B2B Messaging (AS1/AS2/AS3/ebMS) Trading Partner Profile Management B2B Transaction Viewer

DataPower Appliances extends its market leading Security & Integration Gateway

functionality into Virtual Appliances providing deployment flexibility

Business Value: Industry-leading workload security, optimization, and

integration functionality similar to the corresponding physical DataPower appliance models

A flexible, cost effective Security & Integration Gateway for non-production environments

A production solution for environments not suitable for physical appliance deployment

Features: WebSphere DataPower XG45 & XI52 physical appliance

functionality in a “virtual appliance” form-factor running on VMware or Citrix XenServer hypervisor on x86 servers, IBM PureApplication System W1500, & SoftLayer dedicated server or bare metal instance platforms

Ability to upgrade & downgrade firmware similar to physical appliances

Seamless configuration migration between physical and virtual appliances

Powered by a purpose-built platform including an embedded, optimized DataPower Operating System

x86 Server

IBM DataPower Virtual EditionDeployment flexibility plus reduced cost for development & test environments

Agenda

• DataPower Quick Overview

• What’s new in DataPower v6.0 & v6.0.1

• What’s new in DataPower v7.0

• Provides the API gateway functionality for IBM API Management

• Quick integration with IBM Worklight to secure mobile web traffic

• Improved REST services handling with native JSON support including schema validation & query, extract, filter & transform through JSONiq

• New XML data query, extraction & manipulation support with XQuery 1.0

• Enhanced security with: improved OAuth 2.0, new support for Kerberos constrained delegation, and TLS 1.1/1.2

• Improved WS-MediationPolicy consumption from WSRR & SLAs for non-SOAP traffic

• Embedded On-Demand Router functionality for WAS ND environments

• Optimized application delivery with response caching on-the-box & seamless integration with elastic caching XC10 appliances

• New System z integration capabilities allowing IMS transactions to easily consume external web services & easy consumption of IMS data as a service

• Simple ability to create & deploy common DataPower configuration patterns

Highlights of DataPower v6.0

1212 © 2014 IBM Corporation

• Adds Application Optimization (optional add-on module) on XB62 • Support for self-balancing and intelligent load distribution • Eliminate load balancing hops - reducing cost & complexity + improving scalability & performance

• Empowers XB62 to provide API gateway functionality for IBM API Management solution• Enables a converged solution for B2B and API management gateways

• NIST SP800-131a security standard compliance + FIPS 140-2 Level 1 certified cryptography module• Enables U.S. Federal & Public sector customers to meet government mandated security standard• Supported on both physical & virtual appliances

• Enhanced support for Web, Mobile & REST workloads

• Enhanced Configuration Pattern Console• Improved error handling and description• Adds version support for configuration patterns

• Important Note: This firmware is not supported on 9004 appliances, i.e. XS40, XI50 or XB60

• Links:• Release Notes: http://pic.dhe.ibm.com/infocenter/wsdatap/v6r0m1/index.jsp?topic=%2Fcom.ibm.dp.xi.doc%2FrelnotesXI.html

Highlights of DataPower v6.0.1

Agenda

• DataPower Quick Overview

• What’s new in DataPower v6.0 & v6.0.1

• What’s new in DataPower v7.0

GatewayScript: A JavaScript-based gateway runtime which simplifies configuration for developers and provides an easier development paradigm for Mobile, Web, & API

New Virtual Edition for Developers provides a low cost (per user pricing) and easy to use gateway for developers

Support for Citrix XenServer provides additional deployment flexibility for Virtual Edition deployment on-premise & in SoftLayer

WebSocket Proxy support enables full-duplex, bi-directional, & low-latency communication for Web & Mobile applications

Network redundancy & increased throughput with support for Link Aggregation

Enhanced B2B functionality with support for Sterling Multi-Enterprise Integration Gateway (MEIG) integration, robust NFS functionality for storage of B2B payloads

Improved security & traffic control functionality in support of API Management offering

SFTP support on XG45 appliances enables additional DMZ use cases

DataPower Firmware v7.0

DataPower Appliances provides market leading Security & Integration Gateway for Web, Mobile, API, SOA

& B2B, reducing infrastructure complexity & lowering TCO

GatewayScript

• GatewayScript is a JavaScript-based runtime for processing Mobile, Web, and API workloads‒ Focuses on the “Developer” experience, with familiar and friendly constructs

and APIs‒ Why JavaScript?

Popular scripting language, large ecosystem, fast moving community driven, used on both client-side and server-side and now Gateway too

‒ Performance Compiler technology & native execution Ahead of time compilation with caching, not single threaded Built on intellectual capital and expertise from 10+ years securing and optimizing

XSLT parsing/compiler technology‒ Security

Transaction isolation Code injection protection Short lived execution Small footprint

GatewayScript™ (1 of 2)

JavaScript-based gateway runtime which simplifies configuration for developers and provides an easier development paradigm for Mobile, Web, & API

JavaScript-based gateway runtime which simplifies configuration for developers and provides an easier development paradigm for Mobile, Web, & API

GatewayScript™ (2 of 2)

• Easily manipulate JSON and binary data to transform payloads or create gateway functionality

• New Processing Policy Action‒ Transformation style processing policy action ‒ Access to gateway functions through APIs

GatewayScript Modularity

• Gateway functions exposed using modules‒ CommonJS 1.0 Modules‒ Develop custom modules‒ DataPower Modules:

Metadata – headers and variables

Console logging (automatic) Utilities Testing / assertions URL Opener

• Developers can quickly deliver gateway functionality by creating and reusing modules

GS Action

JavaScript Engine

Console(log)

‘output’context

‘input’context

‘INPUT’context

‘named’context

‘named’context

readAs….()

error()

Meta data

Body

modules /libraries meta-

dataUtilities Logging

write()

Testing

Debugger

V1

V2

Vn…

Context Variables

Example GatewayScript

• Use any JavaScript editor to develop GatewayScript

• Pass input context and GatewayScript action writes to an output context

GatewayScript Action1

{“firstName”: “John”, “lastName”: “Doe”}

input

{“firstName”: “John”, “lastName”: “Doe”, “processSteps”: “action1 >> action2”}

output

Debugging GatewayScript

• Debug individual GatewayScript files conditionally‒ GatewayScript action contains a Debug option (script file must contain

“debugger” statement)

• The flow of a transaction is paused indefinitely‒ The GatewayScript processing will break at the “debugger;” line

DataPower Virtual Edition for Developers

VMWare WorkstationVMWare Player

VMWare Fusion

Virtual Edition for Developers provides a low cost and easy to use gateway for developersVirtual Edition for Developers provides a low cost and easy to use gateway for developers

• Deployment support on VMware Type 2 hypervisors (desktop) such as VMWare Workstation/Player/Fusion

Increased developer productivity–Allows developers to have a dedicated copy of DataPower appliance for

development and unit testing on their workstations–Be productive on your workstation anywhere without network

connectivity

Cost-effective DataPower Virtual Edition for Developers –Per user licensing

Available for XG45 and XI52

DataPower virtual Citrix XenServer hypervisor support

Ability to run DataPower virtual edition on Citrix XenServer hypervisor and management using Citrix XenCenter platform– Support XenServer tools and hypervisor

management functions

Enables deployment of DataPower virtual edition on-premise or SoftLayer bare-metal and dedicated server deployment– Expand the usage of DataPower virtual edition

within on-premise data centers or usage on infrastructure as a service (IAAS) public cloud platforms

Data center

Public cloud

Public cloudPrivatecloud

Privatecloud

Privatecloud

Citrix XenServer provides deployment flexibility for deployment on-premise & in SoftLayerCitrix XenServer provides deployment flexibility for deployment on-premise & in SoftLayer

DataPower virtual VMWare hypervisor enhancements

• Enhanced management capabilities on VMWare hypervisor‒ Central management using VMWare vCenter‒ Live migration support using VMWare vMotion

• Enables administrators to use VMWare vCenter to centrally manage multiple instances of DataPower virtual edition appliances‒ Centralized interface for managing your

infrastructure‒ Leveraging vCenter management tools to optimize

resources allocated to virtual machines

• Use vMotion Live Migration to easily migrate DataPower virtual edition without downtime‒ Existing connections, network settings, memory,

execution state are maintained during transfer over high-speed network

SAN

Server A Server B

Trusted Zone

• WebSocket is a full-dulex, bidirectional frame based protocol for enabling real-time communication over supporting HTTP(s) infrastructure‒ Designed to enable real-time applications such as: Messaging over the

Web, Chat Applications, Video Applications, Notifications, …

• Use DataPower to Secure, Route, Shape and Load-balance initial WebSocket connection establishment

WebSocket Proxy (1 of 2)

Full-duplex, bi-directional, & low-latency communication for Web & Mobile applicationsFull-duplex, bi-directional, & low-latency communication for Web & Mobile applications

Websocket serverDataPower Gateway Appliance

Websocket client

DMZ

DataPower Gateway Appliance

DMZ

• Apply DataPower policy actions until and including WebSocket upgrade request over HTTP(s)‒ After upgrade request is accepted, DataPower simply proxies the client

and server communication.

• Example: Chat application using WebSockets require client authentication and connection throttling‒ Use DataPower AAA to authenticate and authorize client credentials and

SLM to enforce connection concurrency

MPGW

WebSocket Proxy (2 of 2)

Full-duplex, bi-directional, & low-latency communication for Web & Mobile applicationsFull-duplex, bi-directional, & low-latency communication for Web & Mobile applications

Networkinfrastructure

WebSocket

server

DataPower Gateway Appliance

HTTP(s) FSHHTTP(s) FSHAAA, SLM, …AAA, SLM, …

WebSocket proxy (pass-thru)

WebSocket proxy (pass-thru)

HTTP(s)HTTP(s)

HTTP

WebSockets

HTTP upgrade: websockets

WebSocket

HTTP(s) FSHHTTP(s) FSH

Link Aggregation (1 of 2)

• Combines multiple Ethernet interfaces into a single logical network interface

• Allows network administrators to improve the availability and/or bandwidth characteristics of the interface

• DataPower supports 3 modes‒ Link Aggregation Control Protocol, or lacp (industry standard)

Requires special switch configuration‒ Active-backup uses only one port at a time

Does not require special switch configuration‒ Transmit uses one port for receive and all available for transmit

Does not require special switch configuration Most helpful where LACP is not possible

Network redundancy & increased throughput with support for Link AggregationNetwork redundancy & increased throughput with support for Link Aggregation

Link Aggregation (2 of 2)

VM VMeth11

VMeth12eth10

Link Agg Interface172.16.8.1

• Expose a single IP address from a set of multiple Ethernet interfaces

• No IP address on ethernet

• VLANs can be used on Link Aggregations

B2B Enhancements

• Enhanced B2B security by offloading security from MEIG to DataPower within the DMZ

• Use DataPower as Secure B2B proxy‒ Perform AS2 signature verification using Multi-Protocol Gateway service

• Integration with Sterling MEIG‒ Retrieve partner and crypto information from Sterling MEIG‒ Send visibility events associated with the transaction to Sterling Message

Fabric

• Allows optimized processing of B2B traffic – use DataPower B2B proxy for B2B security and Sterling MEIG for partner management

Enhanced B2B functionality with support for Sterling Multi-Enterprise Integration Gateway (MEIG) integration, robust NFS functionality for storage of B2B payloads

Enhanced B2B functionality with support for Sterling Multi-Enterprise Integration Gateway (MEIG) integration, robust NFS functionality for storage of B2B payloads

Trusted Zone

DataPower Gateway Appliance

AS2

DMZ

DataPower Gateway Appliance

DMZ

AS2

Application

Server

Document

Sterling MEIG

Partner profile and crypto

IBM API Management

Improved security & traffic control functionality to support API Management offeringImproved security & traffic control functionality to support API Management offeringManagement layer Gateway layer

The management layer embodies the capability for organizations to define,

manage, expose and control APIs.

Provides API Manager, Developer Portal and Management Console

API configurations are deployed to the gateway,

which provides the enforcement point for

runtime policies to control API traffic.

Gateway is DataPower physical or virtual

IBM DataPower

IBM API Management and DataPower Assemble business APIs easily

Provide Secure or Open APIs

Control APIs at a fine-grained level

Explore API documentation

Provision application keys

Developer Portal API Manager Management Console

Define and manage APIs

Explore API usage with analytics

Manage API user communities

Provision system resources

Monitor runtime health

Scale the environment

API Gateway (IBM DataPower)

Analyze API usage

Manage private, partner, public app developers

Provide self-service app developer onboarding

API configurations are deployed to

the gateway, which provides the

enforcement point for runtime

policies to control API traffic.

Applications & Serviceson App Servers(WAS, WAS ND,

or other Provider)

Security & Integration GatewayIBM DataPower Appliance

Mobile Apps& clients

IBM API Management and DataPower

** Available in IBM API Management 2.0

API Integration

API consumers & App Developers

API owners

APIs

Create, Publish, Manage & Socialize APIsIBM API Management

Quick deployment and integration of fully controlled APIs

Developer Portal

Enable “Self Service”

Dashboard and API analytics

manage entitlements, quality of service and developers

simply

Misc Enhancements

• SFTP support on XG45 appliances ‒ Enables new use cases by allowing SFTP on the frontside, backside and

during message processing (i.e. side calls)

• Proxy Application traffic that leverages custom HTTP methods and response codes‒ Use DataPower to proxy non-standard HTTP methods, e.g. ones used by

WebDAV, and apply processing policy actions

• Use the cookie attribute policy to enable granular creation of cookie attributes‒ Generation of cookies within DataPower (HTML Form Login policy and

AAA Post Processing) can be customized based on the environment

• Global transaction id (GTID) for multiple chained services‒ Enables easier correlation of HTTP requests across multiple DataPower

services and appliances

• RSA SecurID One-time password (OTP) support through RADIUS

GatewayScript: A JavaScript-based gateway runtime which simplifies configuration for developers and provides an easier development paradigm for Mobile, Web, & API

New Virtual Edition for Developers provides a low cost (per user pricing) and easy to use gateway for developers

Support for Citrix XenServer provides additional deployment flexibility for Virtual Edition deployment on-premise & in SoftLayer

WebSocket Proxy support enables full-duplex, bi-directional, & low-latency communication for Web & Mobile applications

Network redundancy & increased throughput with support for Link Aggregation

Enhanced B2B functionality with support for Sterling Multi-Enterprise Integration Gateway (MEIG) integration, robust NFS functionality for storage of B2B payloads

Improved security & traffic control functionality in support of API Management offering

SFTP support on XG45 appliances enables additional DMZ use cases

DataPower Firmware v7.0

DataPower Appliances provides market leading Security & Integration Gateway for Web, Mobile, API, SOA

& B2B, reducing infrastructure complexity & lowering TCO

GatewayScript

Over 2000 DataPower Appliance clients• Over 10,000 units sold

• The largest portfolio of SOA appliances

• 60% of customers are repeat buyers

• Appliance Innovator: leading appliance market since 2003

• Broadest support for open standards and programming models

• Proven to accelerate time-to-market and lowers total cost of ownership

IBM DataPower Appliances Lead the Market

“One of the strongest points for IBM comes from its industry-leading experience with both SOA and appliances. Because IBM has been in the SOA game for a long time, it has built up extensive and pervasive SOA skills globally...IBM has developed a solid business approach to the appliance marketplace, taking into account the challenges of adding new members to the range, maintaining a consistent focus and ensuring clients continue to get ongoing value.” -Source: November 2012, Lustratus Research, Inc: A Competitive Review of SOA Applianceshttp://www.lustratus.com/products-page/free-reports/a-competitive-review-of-soa-appliances-2012/

The Leader in SOA Appliances

Gartner reported that IBM continues to be number one in key areas including Integration Appliances- Source: April 2012, “IBM Named Marketshare Leader in Middleware Software” http://www-03.ibm.com/press/us/en/pressrelease/37376.wss

• Used by 95% of top global insurances firms

• SaaS providers, ASPs, regulators, etc.

• Agencies and ministries• Defense and security organizations• Crown corporations

Insurance

Government

Banking

• Healthcare• Retailers• Utilities, Power, Oil and Gas• Telecom• Airlines• Others

Many, many, more

• Majority of the big US and European banks

• All of the big 5 Canadian banks• Numerous regional banks and credit

unions

DataPower Gateway AppliancesOver a decade of innovation & over 2,000 worldwide installations with over 10,000 appliances

35

IBM DataPower Web Page (product info, support, technotes) http://www.ibm.com/software/integration/datapower

http://www.ibm.com/software/integration/datapower/library/documentation

developerWorks DataPower Discussion Area http://www.ibm.com/developerworks/forums/forum.jspa?forumID=1198

Vast library of published articles: http://www.ibm.com/developerworks/websphere/zones/businessintegration/dp.html

(Also search for “DataPower” within “WebSphere”, “SOA/Web Services” and “XML”)

http://www.ibm.com/developerworks/views/websphere/libraryview.jsp (Search “DataPower”)

IBM Redbooks: http://www.redbooks.ibm.com/cgi-bin/searchsite.cgi?query=datapower

DataPower SOA Appliance Handbook http://www.amazon.com/IBM-WebSphere-DataPower-Appliance-Handbook/dp/0137148194

DataPower on YouTube: http://www.youtube.com/playlist?list=PLZ9KuL1mvl0UU4JcomW-_5U3MRES3u4Am

DataPower user community on LinkedIn: http://www.linkedin.com/groups/DataPower-IMPACT-4820454/about

IBM DataPower Appliance Resources

More resources