7.0 Protecting an Identity Server with an Access Gateway

For security reasons, you might want to set up your Access Manager configuration so that the Identity Server is a resource protected by an Access Gateway. This configuration reduces the number of ports you need to open between the outside world and your network. Figure 7-1 illustrates such a configuration.

Figure 7-1 Identity Servers behind an Access Gateway

With this configuration, you need an L4 switch to cluster the Access Gateways. However, you do not need an L4 switch to cluster the Identity Servers. When the Identity Server is configured to be a protected resource of the Access Gateway, the Access Gateway uses its Web server communication channel. Each Identity Server in the cluster must be added to the Web server list, and the Access Gateway uses its Web server load balancing and failover policies for the clustered Identity Servers.

Limitations: The following features are not supported with this configuration:

Configuration Options: To configure Access Manager in this manner, you must perform the following changes to the basic configuration.