Forum Discussion

Przemyslaw's avatar
Przemyslaw
Icon for Nimbostratus rankNimbostratus
Feb 04, 2021

attach SNI to TCP connection

Hello gents,

 

I am struggling with following configuration.

 

Server with JBoss which connects to F5 VS which listens on ports 30004 and 30005

 

I would like to Connect with JBoss on port 30004 and port 30005(TCP connection) to F5. If client (jboss) is connected to F5 with SSL then at F5 level SNI values could be attached to the frames if connection is established on particular port.

If connection is established on 30004 then attach sni - siteA.com and if port is 30005 then attach sni siteB.com after that forward traffic to a member of a pool.

 

Is that doable? What i have to configure? What I rule I should use? I am not so fluent in writing iRules. :-)

 

Can you help me with that?

application delivery
devops
iRules
LTM
  • Enes_Afsin_Al's avatar
    Enes_Afsin_Al
    Icon for MVP rankMVP
    Feb 04, 2021

    Hi Przemyslaw,

    Can you try this iRule?

    when HTTP_REQUEST {
	set sni_value [getfield [HTTP::host] ":" 1]
	
	if { [HTTP::host] ends_with "30004" } {
		set sni_value "siteA.com"
	}
	elseif { [HTTP::host] ends_with "30005" } {
		set sni_value "siteB.com"
	}
}
 
when SERVERSSL_CLIENTHELLO_SEND {
	SSL::extensions insert [binary format SSScSa* 0 [expr { [set sni_length [string length $sni_value]] + 5 }] [expr { $sni_length + 3 }] 0 $sni_length $sni_value]
}
    • Przemyslaw's avatar
      Przemyslaw
      Icon for Nimbostratus rankNimbostratus
      Feb 04, 2021

      Hi Enes,

       

      Thank you for fast reply, I really appreciate it.

       

      Sure I will have a look if it works.

       

      in this event there is HTTP_REQUEST - Will it also work for TCP connection?

       

      I will get back to you after tests.