AGS-Enabled vServices

AGS-Enabled vServices is the place where a vService with the AGS access control enabled is monitored and managed from a single screen. The screen brings together in tabs the access dashboard of the vService, its AGS configuration and login flow, its live statistics, its open sessions, its lockouts, its TOTP records, its audit events, its bot protection tables and its AGS engine.

Since AGS is turned on separately for every vService, this screen is per vService as well: the login flow, the gateway mode, the sessions, the lockouts, the TOTP records, the audit events and the engine of a vService concern only itself; in the Portal and Portal Application modes the session is shared between the portal and the applications it publishes. The profiles selected in the flow and in the settings, on the other hand, are defined device-wide: the authentication providers, servers, local databases and MFA profiles are located under Authentication, the session, lockout and bot policies together with the CAPTCHA providers under Protection Policies, the login forms, templates and dictionaries under Pages & Language, and the Backend SSO, notification and log forwarding profiles under Integrations, and they are used in common in more than one vService.

The AGS-Enabled vService List screen is used for the device-wide view. There is no separate device-wide log or report screen for AGS; the audit events are examined on the Audit Logs tab of the vService and are forwarded to the SIEM and syslog targets with the Log Forwarding profiles.

If AGS is not turned on yet

How AGS is enabled in an HTTP vService and the default configuration created after the enabling are explained on the How to Enable AGS? page.

Accessing the Screen

1. Left Monitor Panel is opened.
2. AGS-Enabled vServices is selected from the category tabs at the top left.
3. The vServices defined on TR7 with AGS access control enabled are listed.
4. The vService to be monitored is clicked; the screen opens with the Dashboard tab that carries the vService's name.

The category is open to the users who have the Load Balancer authorization and is one of the default categories of the panel; since the panel tabs can be arranged per user, if it has been removed before it is added again from the same selector. Since AGS works only in the vServices of the HTTP type, only this type is located on the list. The default primary metric of the list is AGS Concurrent Sessions; in the rows the vService name, the status color of the AGS engine and this metric are displayed. From the metric selection of the panel, besides the AGS metrics, Actions (the chain of steps the visitor has passed) and Portal Applications (the number of applications the portal publishes) can be selected as the primary metric as well, and in the Advanced view these are added to the row as an additional metric.

The same screen is also opened with the Dashboard icon of the preview panel on the AGS-Enabled vService List screen; the Edit operation of the preview and of the right-click menu opens the screen directly on the AGS Management tab. Clicking a row on the list does not open the screen, it only shows the preview. The Management → link displayed on the AGS card while AGS is enabled, in the Security Modules section on the Load Balancer vService screen, also opens this screen on the AGS Management tab; the Sign-in Flow card in the preview drawing of the Load Balancer vService dashboard, on the other hand, opens the Flowchart tab with the View Mode.

The open tab is carried between the vServices

When it is passed from an AGS-enabled vService to another, the tab open at that moment is preserved; this rule is valid for all the tabs. Only when the Bot Protection tab is open and it is passed to a vService that does not have this tab, the screen opens with the Dashboard tab. In the entries that do not state a tab (when it is come from the module menu of the Load Balancer, WAF or Bot/DDoS dashboard or from the Dashboard icon in the AGS-Enabled vService List preview), the screen opens with the Dashboard tab; the entries that target a specific tab such as Edit and Management → open that tab.

Tabs

Tab	Visibility Condition	Content
The vService name	Always	The dashboard of the session, authentication, lockout, MFA, system and bot metrics of the vService with a selectable time range (Dashboard).
AGS Management	Always	The surface on which the AGS configuration of the vService is read section by section with sentences and is edited with the section windows.
Flowchart	Always	The canvas on which the login flow is displayed and edited as a flowchart; the General Settings window and the User Attributes panel.
Live Stats	Always	The access, session, authentication, CAPTCHA, MFA, lockout and storage counters refreshed once a second.
Sessions	Always	The list of the sessions the AGS engine has opened and the session termination.
Lockout	Always	The failed attempt counters the lockout policies keep and the active lockouts.
TOTP	Always	The authenticator application records of the users and the record resetting.
Audit Logs	Always	The audit record on which the authentication, MFA, lockout and access decision events are listed according to the time range.
Bot Protection	If at least one bot protection policy that keeps a table has been assigned to the vService	The screen on which the live counting and block tables of the bot protection policies are listed and cleaned.
Engine	Always	The state of the AGS engine per device and the maintenance operations.

The Bot Protection tab is displayed only if a bot protection policy that keeps a table has been assigned to the vService: the policies whose trigger is Requests or Auth Failures and the policies whose action is Block keep a table. Since Standard Rate Limiting, one of the default policies created when AGS is enabled for the first time in a vService, meets this condition, the tab is displayed in the default configuration.

All of the tabs are fixed; there is no closable tab on the screen. The editing surfaces of the AGS Management sections are opened not as a separate tab but as a window.

The authorization of the tabs

The whole of the screen is protected with monitoring authorization in the Load Balancer area; if this authorization is absent, the screen does not open. When the screen is opened, the tabs are not bound to an authorization condition separately. There is no authorization area specific to AGS: the fetching of the session, lockout, TOTP and audit records requires the Load Balancer view authorization, and the operations on these records together with the engine maintenance and the saving of the configuration require the Load Balancer change authorization. The fetching and the cleaning of the Bot Protection tables require the Load Balancer change authorization as well.

In a user who has only the WAF authorization, the screen does not open. The AGS-Enabled vServices category in the Left Monitor Panel is displayed only with the Load Balancer authorization as well.

Division of Labor Between Tabs

What is happening? Dashboard · Live Stats

Dashboard gathers in panels the session, authentication, lockout and MFA data in the selected time range; Live Stats shows the current state of the same vService with counters refreshed once a second.

How is it configured? AGS Management · Flowchart

AGS Management summarizes the AGS configuration of the vService section by section with sentences and has every section other than the login flow edited in its own window. The login flow is edited only on the Flowchart tab; the flow editing links on this screen open the tab in Edit Mode. The gateway mode is selected from the General Settings window of the Flowchart or from the Edit window in the mode section of the AGS Management.

Who is inside right now? Sessions · Lockout · TOTP

The open sessions, the active lockouts together with the attempt counters and the TOTP records are listed from the session store of the AGS engine, with their state at the moment they are displayed. The intervention is done from the same screen: a session is terminated with Revoke Session(s), a lockout is removed with Clear Lockouts, and the record of a user who has lost their phone is reset with Reset TOTP.

What happened, and why? Audit Logs

The question "Why could this user not log in?" is answered here: the authentication attempts, the MFA steps, the lockout warnings and the access decisions are examined event by event, according to the selected time range. While the Sessions and Lockout tabs show the instantaneous state, Audit Logs keeps the record looking back.

Protection and the engine Bot Protection · Engine

Bot Protection shows which client the bot policies are counting and whom they are blocking; a client blocked by mistake is released before its time expires. Engine shows the health of the AGS engine per device; if the counters are not advancing or the users cannot reach the login page, this tab is the first place to look.

Subpages

Dashboard

The AGS dashboard: the view tabs, the preview panel that summarizes the access flow as a diagram, the time range and the panel controls.

→

AGS Management

The configuration summary: the mode, login flow, session, protection, portal, page and language, monitoring and notification sections together with the section based Edit windows.

→

Flowchart

The flow editor: the View Mode and the Edit Mode, the AGS action types, the General Settings window, the working of the flow at run time and the User Attributes panel.

→

Live Stats

The live statistics: the Frontend, Access, AGS Sessions, Authentication, Captcha, MFA, Lockouts, System and Storage sections.

→

Sessions

The open sessions: the authentication state, the user fields, the Revoke Session(s) operation and the session preview.

→

Lockout

The lockouts and the attempt counters: the Failure and Lockout records, the Clear Lockouts and Reset Failures operations.

→

TOTP

The TOTP records: the number of remaining backup codes, the Reset TOTP operation and the record preview.

→

Audit Logs

The audit events: the level and the event code, the filter cards, the session and user information, the preview with the JSON context.

→

Bot Protection

The bot tables: the Counter and Block rows, the Reset Counters and Remove Blocks operations.

→

Engine

The engine cards: the state, the uptime, the memory and storage usage, Restart Engine and Clean Storage.

→

The Gateway Modes

Standalone Application

The default mode that protects the application behind the vService with its own login flow.

→

Portal

The common entry point at which the users reach the published applications with a single login.

→

Portal Application

The application mode that takes over the session from the trusted portal and does not offer its own login page.

→