Forum Discussion

jk20004_44080's avatar
jk20004_44080
Icon for Nimbostratus rankNimbostratus
Oct 05, 2018

best way to reject SSL Connections

We use IPI and we drop the requests via iRule because we cannot use ASM at every VS. today we reject the connect in then CLIENT_ACCEPTED but the result is a   SSL Handshake failed for TCP xxx.xx...
ipi
iRules
security
Andy_McGrath's avatar
Andy_McGrath
Icon for Cumulonimbus rankCumulonimbus
Oct 06, 2018

You are getting SSL error as the CLIENT_ACCEPTED event is triggered once the TCP connection has been established so the client has likely already sent the SSL Client Hello before being rejected.

 

Personally if this is for security and public I would drop the connection instead of rejecting it. These will mean the client TCP connection will timeout.