KASM Workspaces Integration with F5 BIG-IP Zero Trust Access

Key Concepts

• F5 BIG-IP: An Application Delivery Controller (ADC) used for load balancing, traffic management, and security.
• Kasm Workspaces: A platform for delivering containerized desktop and application streaming.
• Zero Trust Access (ZTA): A security framework requiring strict identity verification for every person and device trying to access resources.
• SSL Decryption: The process of decrypting encrypted traffic to inspect it for security threats before re-encrypting it.
• Source Address Translation (SNAT): A method to map internal IP addresses to a public or virtual IP address.
• Health Monitor: A mechanism to verify the availability and status of backend server members.

---

1. Configuration Methodology: Manual Virtual Server Setup

The video demonstrates a manual configuration of F5 BIG-IP to integrate with Kasm Workspaces, bypassing the use of automated FAST (F5 Application Services Templates) templates.

Step-by-Step Process:

1. Create an HTTP Monitor: Define a health check to ensure the Kasm server is responsive.
   • Type: HTTP.
   • Request: Specific HTTP request string configured for Kasm.
   • Expected Response: "OK".
2. Create a Load Balancing Pool:
   • Assign the previously created HTTP monitor to the pool.
   • Add the Kasm server member (e.g., 10.1.20.23).
3. Configure the Virtual Server:
   • Type: Standard.
   • Destination: Set the listener IP and port (443).
   • SNAT: Set Source Address Translation to "Automap" to handle address translation between the client and the Kasm server.
   • Resources: Assign the Kasm pool as the default pool for the virtual server.

2. Kasm Workspaces Infrastructure Requirements

Before the F5 integration can function, the Kasm environment must be properly configured:

• Zones: A zone must be configured within the Kasm infrastructure (default settings are sufficient).
• Workspaces: Applications must be defined within the Kasm workspace to be accessible to the end-user upon login.

3. SSL Decryption and Security Enhancement

To achieve full control over authentication and security policies, the presenter demonstrates enabling SSL decryption on the F5 BIG-IP:

• Protocol Profiles: Set the HTTP profile to "HTTP" for both client and server sides.
• SSL Profiles: Add the appropriate SSL Client and SSL Server profiles to the virtual server configuration.
• Purpose: This allows the BIG-IP to inspect traffic, providing deeper visibility and enabling the enforcement of Zero Trust security policies.

4. Validation and Testing

• Health Status: The F5 BIG-IP dashboard provides a visual indicator (green status) confirming the health monitor is successfully communicating with the Kasm server.
• User Experience: The presenter logs in as a user, accesses the Kasm dashboard, and launches a browser (Firefox) within the Kasm container. The browser session is successfully proxied through the F5 BIG-IP, demonstrating that the containerized application is reachable via the secure gateway.

5. Synthesis and Conclusion

The integration of Kasm Workspaces with F5 BIG-IP provides a robust, secure method for delivering containerized applications. By manually configuring the virtual server and implementing SSL decryption, administrators can leverage F5’s advanced traffic management and security features to enforce Zero Trust principles. The successful health check and functional browser launch confirm that the traffic flow—from the user through the F5 BIG-IP to the Kasm server—is correctly established and operational.