W-14219104-Traffic-inspection-LDS #697
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||
|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,110 @@ | ||||||||
| = Traffic Inspection for Standalone Mules | ||||||||
|
Contributor
There was a problem hiding this comment. This topic doesn't appear in the TOC on the beta site. Where will it live? I think we need to take a closer look at the hierarchy of sections in this topic. The Mule Installation section structure is good (and task oriented) (Bravo!), but I think you can combine some of them and/or link to existing topics to reduce the amount of text here. I would love to figure out how to flatten the hierarchy a little so that the main tasks (H2) appear in the right-hand TOC, if possible. |
||||||||
| ifndef::env-site,env-github[] | ||||||||
| include::_attributes.adoc[] | ||||||||
| endif::[] | ||||||||
| :keywords: agent, runtime manager, traffic inspection, standalone | ||||||||
| :page-deployment-options: hybrid | ||||||||
|
|
||||||||
| The Traffic Inspection feature for Mules adds support in the agent for a forward proxy that is deployed in customer premises and acts as a man in the middle between the Mule and the control plane by intercepting and inspecting all HTTPS traffic. | ||||||||
|
|
||||||||
| == Prerequisites | ||||||||
|
Contributor
There was a problem hiding this comment. We use "Before You Begin" for prereq topics. |
||||||||
|
|
||||||||
|
Contributor
There was a problem hiding this comment. Our style is to not have two headings in a row without content.
Contributor
There was a problem hiding this comment. I think you can remove the Once you revise the bullet list to be more paragraphy, you can make it clear that the prereqs are for the Proxy. |
||||||||
| === Traffic Inspection Proxy | ||||||||
|
|
||||||||
| * An HTTP Inspection Proxy is required, with support for TLS connections to the runtime client, and mTLS connections to the control plane server. | ||||||||
|
Contributor
There was a problem hiding this comment. I'm not sure why this is a bullet list. Perhaps the first two bullets should be a paragraph and the third a separate paragraph/intro to the sub-bullet list? Review the guidelines in the Style Ref on bullet lists: |
||||||||
| * The Inspection Proxy server does not require client authentication from the agents. The proxy does not require the Mule Agent to present a client certificate. The communication between the Mule Agent and the inspection proxy is TLS, not mTLS. | ||||||||
| * The inspection proxy must be provisioned to send a BofA private certificate to the Mule Agent. The Mule Agent uses a Certificate Authority from the JVM's keystore to validate the public certificate presented by the inspection proxy. | ||||||||
| * The the inspection proxy and the MuleSoft control plane communicate via mTLS communication. There are two certificates involved: | ||||||||
| ** The control plane presents a MuleSoft Public server certificate to the Inspection Proxy. The proxy must be provisioned with the correct Certificate Authority to validate the server certificate presented by the MuleSoft Control Plane | ||||||||
| ** The control plane requires a client certificate from the inspection roxy. This certificate must be the one shared by BofA to MuleSoft on April 17th, 2023, with serial number `133250979737618478378908091430693006357` and Common Name `anypoint-test.bankofamerica.com`. | ||||||||
|
luanamulesoft marked this conversation as resolved.
Outdated
|
||||||||
| + | ||||||||
| [NOTE] | ||||||||
| Communication with the control plane might fail if the certificate does not match the specified serial number and common name. | ||||||||
|
luanamulesoft marked this conversation as resolved.
Outdated
|
||||||||
|
|
||||||||
| == Mule Installation and Registration Steps | ||||||||
|
|
||||||||
|
Contributor
There was a problem hiding this comment. Need some content between headings here.
Contributor
There was a problem hiding this comment. Our style is to not use self-referential language like "steps". Instead, reframe to be a task (with an imperative). == Install and Register Mule |
||||||||
| Provision the truststore of the Java Virtual Machine with the Root CA of the Proxy:: | ||||||||
|
|
||||||||
| . Identify the folder location of the Java Virtual Machine. | ||||||||
|
luanamulesoft marked this conversation as resolved.
Outdated
|
||||||||
| . Insert the Root CA of the proxy in the truststore of the mule's JVM: in your terminal window run the following command, replacing `$JAVA_HOME` with the actual path: | ||||||||
| + | ||||||||
| [source,console,linenums] | ||||||||
| ---- | ||||||||
| sudo keytool -import -alias testCert -keystore $JAVA_HOME/jre/lib/security/cacerts -file proxy_cacert.pem | ||||||||
| ---- | ||||||||
| + | ||||||||
| . Password is `changeit`. | ||||||||
| . If you have multiple versions of Java, insert the certificate in the version that is being used by the Mule runtime. | ||||||||
|
luanamulesoft marked this conversation as resolved.
Outdated
|
||||||||
|
|
||||||||
| [[install-mule-runtime]]Install the Mule Runtime:: | ||||||||
|
|
||||||||
| . Install the latest available Mule Runtime version, which currently is `4.4.0-20230918`. You can skip this step if already installed. | ||||||||
| + | ||||||||
| To check the latest Mule Runtime version, see xref:release-notes::mule-runtime/mule-esb.adoc[]. | ||||||||
|
luanamulesoft marked this conversation as resolved.
Outdated
|
||||||||
| + | ||||||||
| [NOTE] | ||||||||
| The Mule Runtime Installation bundle includes both the Mule Runtime Engine and the Mule Runtime Agent. | ||||||||
|
|
||||||||
| Upgrade the Mule Runtime Agent:: | ||||||||
|
|
||||||||
| Make sure that the version of the Mule Runtime Agent is `2.5.6` or later. If you have an earlier version, update the runtime agent before registering. | ||||||||
| + | ||||||||
| To update the Runtime Agent: | ||||||||
| + | ||||||||
| . Download the Agent's zip file | ||||||||
| . Extract the downloaded `agent-setup-2.5.6.zip` file to `$MULE_HOME/bin`. | ||||||||
|
luanamulesoft marked this conversation as resolved.
Outdated
|
||||||||
| + | ||||||||
| If prompted, overwrite any conflicting files. | ||||||||
| . Do NOT run `amc_setup -U`. | ||||||||
|
Contributor
There was a problem hiding this comment.
Suggested change
|
||||||||
|
|
||||||||
| Register the Mule Runtime:: | ||||||||
|
|
||||||||
| . Update the file `wrapper.conf` file with the IP and port of the traffic inspection proxy by following instructions in xref:rtm-agent-proxy-config.adoc#set-up-proxy-server-configuration-in-the-wrapper-conf-file[Set Up Proxy Server Configuration in the wrapper.conf File]. | ||||||||
|
Contributor
There was a problem hiding this comment. file is duplicated here. |
||||||||
| . Login in to the Anypoint console. | ||||||||
|
Contributor
There was a problem hiding this comment.
Suggested change
|
||||||||
| . From the Anypoint Platform, select *Runtime Manager*. | ||||||||
|
Contributor
There was a problem hiding this comment.
Suggested change
Contributor
There was a problem hiding this comment. Product names don't get articles (the). |
||||||||
| . Click *Servers* in the navigation menu. | ||||||||
|
Contributor
There was a problem hiding this comment. We use "select" for menu choices (and "click" for buttons). |
||||||||
| . Click *Add Server* . | ||||||||
|
Contributor
There was a problem hiding this comment.
Suggested change
|
||||||||
| + | ||||||||
| image::traffic-add-server.png[] | ||||||||
|
|
||||||||
| + | ||||||||
| . In a terminal window, change the `$MULE_HOME/bin` directory to the Mule instance that you're registering. | ||||||||
| . Paste the command on the command line and append the proxy's IP address or domain name and port, and the `--enable-traffic-inspection `configuration flag. | ||||||||
| + | ||||||||
| [source,console,linenums] | ||||||||
| ---- | ||||||||
| ./amc_setup -H 42081e44-288b-4ebc-a1b5-6092a7cbd9d5---1 server-name -P proxy.bofa.com 4128 --enable-traffic-inspection | ||||||||
| ---- | ||||||||
| + | ||||||||
| [NOTE] | ||||||||
| Make sure to leave a space between the proxy's domain name and port number. | ||||||||
| + | ||||||||
| . Confirm that the mule has registered successfully. The runtime should show up as *Created* in the Anypoint console: | ||||||||
|
luanamulesoft marked this conversation as resolved.
Outdated
|
||||||||
| + | ||||||||
| image::mule-registered.png[] | ||||||||
|
|
||||||||
| + | ||||||||
| . Edit the file `$MULE_HOME/conf/mule-agent.yml` and set the property `authenticationProxy.endpoint` to `null`. | ||||||||
| . Start the mule. | ||||||||
|
|
||||||||
| Check that the mule runtime is connected to the control plane:: | ||||||||
|
|
||||||||
| If the connection was successful, you should see the runtime with status *Running* in the Anypoint console: | ||||||||
| + | ||||||||
| image::mule-running.jpg[] | ||||||||
| + | ||||||||
| Also, if the connection has been established, the mule agent terminal window displays the following message: | ||||||||
| + | ||||||||
| [source,console,linenums] | ||||||||
| ---- | ||||||||
| INFO 2023-04-19 17:27:41,307 [WebSocketInboundExecutor] [processor: ; event: ] com.mulesoft.agent.transport.handlers.GenericWebSocketHandler: Opening Mule Agent WebSocket | ||||||||
| INFO 2023-04-19 17:27:41,316 [WebSocketInboundExecutor] [processor: ; event: ] com.mulesoft.agent.transport.handlers.GenericWebSocketHandler: Mule Agent WebSocket opened | ||||||||
| INFO 2023-04-19 17:27:41,316 [pool-12-thread-1] [processor: ; event: ] com.mulesoft.agent.transport.connections.AsyncHttpWSConnectionThread: Mule Agent WebSocket connection was initialized after: 1 attempts | ||||||||
| INFO 2023-04-19 17:27:42,179 [WebSocketInboundExecutor] [processor: ; event: ] com.mulesoft.agent.services.security.HandshakeAuthorizationService: WebSocket Client connection authorized | ||||||||
| ---- | ||||||||
|
|
||||||||
| == Notes | ||||||||
|
Contributor
There was a problem hiding this comment. This seems like a catch-all section. Is there any way to include this information elsewhere? Maybe in the intro? In general, we want to avoid headings like "Notes" and put important things earlier in the topic, with descriptive headings.
Contributor
There was a problem hiding this comment. Take a look at the bullet list guidance. I think this might be better presented as paragraphs. |
||||||||
|
|
||||||||
| * For agent version 2.5.6, you cannot renew mule certificates from Runtime Manager. If you need to renew your certificates, follow the instructions in xref:servers-cert-renewal.adoc#renew-a-certificate-via-the-command-line[Renew a Certificate via the Command Line]. | ||||||||
|
Contributor
There was a problem hiding this comment.
Suggested change
Contributor
There was a problem hiding this comment. That anchor looks autogenerated. Might be worth defining a custom one :) |
||||||||
| ** Use version `2.4.37` of the application. | ||||||||
|
Contributor
There was a problem hiding this comment. Which application? Certificate? |
||||||||
| ** Certificates are valid for 2 years out of the box. | ||||||||
|
Contributor
There was a problem hiding this comment. Our style is to spell out numbers one through nine.
Contributor
There was a problem hiding this comment. What does "out of the box" mean in this context? Two years after they're applied? |
||||||||
| * To enable traffic inspection, the mule runtime and agent must be installed from scratch as per instructions in this document. Upgrading from a standalone mule deployed in a PCE environment is not supported. | ||||||||
| ** Using a runtime version earlier than the one specified in <<install-mule-runtime>> might result in some functionality not working as expected. | ||||||||
Uh oh!
There was an error while loading. Please reload this page.