For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

PiotrL's avatar
PiotrL
Icon for Cirrus rankCirrus
May 29, 2018

Client SSL profile based on a client ip address and SNI

How can I configure an irule to apply different client SSL profiles depending on 2 conditions: client address and SNI (Server Name Indication) ?  
application delivery
iRules
LTM
Stanislas_Piro2's avatar
Stanislas_Piro2
Icon for Cumulonimbus rankCumulonimbus
May 29, 2018

If you want to select client SSL profile based on client IP, you can create 2 virtual servers with same destination address, but with source IP condition.

 

SNI based profile selection is automatic when you assign more than one profile in VS. one and only one of these profile must have "Default for SNI" enabled. VS1 :

 

  • source 0.0.0.0/0
  • destination 1.2.3.4
  • ssl profiles:
    • SSL_company.com (default for SNI)
    • SSL_company.org
    • SSL_company.co.uk

VS2:

 

  • source 172.16.0.0/12
  • destination 1.2.3.4
  • ssl profiles:
    • SSL_company.com_VS2 (default for SNI)
    • SSL_company.org_VS2
    • SSL_company.co.uk_VS2