For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

mikegray_198028's avatar
mikegray_198028
Icon for Cirrus rankCirrus
Oct 15, 2018

disable client authentication

hello team,   We have one vip running with a client ssl profile with client auth enabled. can we disabled client auth based on url using irule?  
application delivery
BIG-IP
iRules
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Oct 16, 2018

same host name only difference is client authentication enabled on one

 

It matters because you can't modify an SSL profile (OSI layer 6) on data you receive after decryption (layer 7). If you're switching based on the URI (path), you're only option is to force a renegotiation. You can either do this in a rather complex iRule, or APM can do it naturally using step-up auth: https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-sso-13-0-0/20.html