Overview

In an inSync Private Cloud deployment, the inSync client might back up data outside the organization's firewall. This means providing access to the inSync Master and the inSync Storage Nodes from outside the firewall. As a security policy, your organization might not allow connections or requests that come from devices outside the firewall. In such scenarios, we recommend the use of inSync Edge Servers.

The inSync Edge Server sits in a demilitarized zone (DMZ), outside your organization's firewall and facilitates communication between the inSync client and the inSync Master, or the inSync client and the inSync Storage Node. By validating the requests that the inSync client sends to the inSync Master or to the inSync Storage Node, the inSync Edge Server introduces an additional layer of security. The inSync Edge Server acts as a gateway that filters requests via unauthorized networks to counteract the vulnerability of the Private Cloud setup.

inSync Edge Server deployment architecture

The following diagram illustrates a sample deployment of inSync Private Cloud with inSync Edge Servers. The organization has geographically distributed location, and each location is protected by a firewall.

As illustrated in the diagram, at least one inSync Edge Server is required for each location. Once inSync Edge Server is configured for the inSync Master or the inSync Storage Node. inSync Master and inSync Storage Nodes that are within the same network communicate directly. When the inSync Master needs to communicate with inSync Storage Nodes that are outside the network, the inSync Master communicates through the inSync Edge Server. The inSync client communicates with the inSync Master or the inSync Storage Node through the inSync Edge Server.

Authentication and security

The following diagram illustrates the communication between the inSync client, inSync Edge Server, inSync Storage Node, inSync Master, and your firewall.

• All communication between various components are encrypted by using 256-bit SSL encryption.
   
• When the inSync Master connects with the inSync Edge server, inSync uses a shared unique key between the inSync Master and the Edge Server to authenticate the connection. This ensures that no untrusted application acts as the Edge Server or the inSync Master. Once the authentication is successful, a persistent connection is established between the inSync Master and the inSync Edge Server. The same authentication mechanism is used between the Storage Node and the Edge Server.
   
• No incoming connection is required from anywhere outside the network to the inSync Master or the inSync Storage Node. Additionally, there are no outgoing connections from the Edge Server to the inSync Master or the inSync Storage Node. Therefore, you do not need to open any port on your firewall for inSync servers.
   
• By default, the Edge Server has self-signed SSL certificates loaded. Customers can also choose to load their own certificates for production use.
   
• When inSync client users who are outside the enterprise network try to connect with the Edge Server, the inSync client checks for certificate fingerprint and also refers to the root CA repository to verify the Edge Server identity. If the certificate fingerprint check fails, the inSync client stops communicating with the Edge Server.
   
• The inSync Master also authenticates the inSync client and ensures that requests are coming from an authentic client. This prevents any man-in-the-middle attack.

Data flow through the inSync Edge Server

The following table explains the data flow between the inSync client, inSync Master, inSync Storage Node, and inSync Edge Server.

Data Flow through Client Activation

The following table explains the data flow required to activate the Client:

Data Workflow for Backup & Restore

The following table explains the data flow required to activate the Client:

Data flow for Web traffic

The following example explains the data flow of web traffic and contains following components:

The following table explains how to setup a connection between Client and Web console:

The following table explains the data flow to download files from the Web:

Edge Server for inSync Share

After you have Edge Server configured in your inSync Private Cloud deployment, the Edge Server lets you access all features of inSync Share. You can install and activate the inSync client, back up and restore data by using the inSync client or inSync Web, launch inSync Web from the inSync client, create and share links with others, and so on.

The advantages of configuring the Edge Server for inSync Share include:

• Access to inSync functionalities, even if you are on a public network and do not have VPN access.
• Access to inSync functionalities, even if you are on an enterprise private network that is on a geographically different site.

The inSync Edge Server is located in a demilitarized zone (DMZ) outside the organization's firewall, and acts as a gateway to the public internet. The DMZ has only one port available for incoming connections. The enterprise private network has only one port available for outgoing connections in their firewall. The Edge Server addresses all the requests from port 443, such as the client Remote Procedure Call (RPC) traffic and browser HTTP traffic. 

How the Edge Server resolves IP addresses

This section provides an example to help you understand how the Edge Server resolves IP addresses for the inSync Server and the inSync Storage Node. Consider the following scenario for an inSync Private Cloud deployment.

The scenario illustrated in the diagram involves the following components:

In this deployment scenario, the Edge Server resolves the configured IP/FQDN setting as follows:

For more information about the authentication workflow of Edge Server, see Edge Server FAQs.