Forum Discussion

Tham_T__330907's avatar
Tham_T__330907
Icon for Nimbostratus rankNimbostratus
Nov 17, 2017

Any iRules that acts as Virtual Server for By-Pass Cert

F5 APM with SWG module, so this F5 acts as Proxy and Intercept Cert.

I have a problem about intercept certificate some website cannot use it, then I solved that problem by create the new virtual machine and fixed the destination of each website's IP. (nslookup)

But I think it's not a good solution, because If some website occurs like this problem more, I have to add more virtual server. So I try to use iRules to by-pass the destination by using iRules.

when CLIENT_ACCEPTED {
if { [ IP::Addr [IP::local_addr] equals "xxx.xxx.xxx.xxx" ] } {
SSL::disable
} 
}

But it's did not work, please could you suggest me for the iRules command.

BIG-IP Access Policy Manager (APM)
certificate
intercerpt
iRules
proxy
security
swg
  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Nov 21, 2017

    if you disable SSL on client side you also have to :

    • disable SSL on server side
    • disable any L7 profile decoding inner protocol

    you can try this:

    when CLIENT_ACCEPTED {
    if { [ IP::Addr [IP::local_addr] equals "xxx.xxx.xxx.xxx" ] } {
        ACCESS::disable
        HTTP::disable
        SSL::disable clientside
        SSL::disable serverside
    } 
}