For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

InquisitiveMai's avatar
InquisitiveMai
Icon for Cirrostratus rankCirrostratus
Dec 06, 2023

Can a pool member initiate a Secure session through F5

Is it possible for two seperate F5s  to communicate and do SSL offloading. The pool member of one F5 ex F5A would initiate the session through F5A . F5A would talk to F5B, F5B would talk to the B poo...
application delivery
Paulius's avatar
Paulius
Icon for MVP rankMVP
Dec 07, 2023

InquisitiveMai Would you be able to provide a connectivity flow diagram as well as an example of what type of communication is occurring? I'm just not seeing why F5A would even need to be involved in the communication flow other than to forward traffic onto F5B like it does any other communication. Typically on F5A you have a forwarding VS that will route any traffic other than all the other VS to the destination. So clientA which is a node behind F5A would initiate an SSL connection to a VS on F5B which is encrypted after the SSL handshake and then F5B will balance that communication to pool members in the pool that is associated to the VS on F5B which would be an encrypted connection from end to end without involving F5A other than forward traffic like it would for any other routed traffic passing through it.

  • InquisitiveMai's avatar
    InquisitiveMai
    Icon for Cirrostratus rankCirrostratus
    Dec 07, 2023

    I am just trying to see if there is anything we could do to use the VIP ip address or a single ip address for client connection similar to home internet NAT.  Just a thought to see if there is anyway we can reduce updating the cert on multiple clients. Also using a same ip to reduce the number of firewall rules when different clients( which may be a node behind aF5) try to talk to another vip on different f5.