Forum Discussion

Jhaunu_Gupta's avatar
Jhaunu_Gupta
Icon for Nimbostratus rankNimbostratus
Oct 12, 2018

Do we have any option to do ssl offloading at global level?

we have two F5 ,one for SSL offloading and GTM,another for LTM config,so can we do ssl offloading except LTM?

 

BIG-IP
LTM
security
  • Lee_Sutcliffe's avatar
    Lee_Sutcliffe
    Icon for Nacreous rankNacreous
    Oct 12, 2018

    GTM/DNS is an intelligent DNS solution - DNS is an out of band service so by it's nature only provides the IP address to requested resource, it does not host the resource it's self (unless the LTM module is provisioned on the same device)

     

  • youssef_100679's avatar
    youssef_100679
    Icon for Nimbostratus rankNimbostratus
    Oct 12, 2018

    Hi,

     

    Offload ssl can be done without LTM license, let me explain. let's assume that a client buys the ASM only. he will have to use the ssl offoload to control the flow that passes through his equipment.

     

    If you have hardware depending of your license, you can set off-loading processor-intensive SSL encryption and decryption from a server to a device configured to accelerate the SSL encryption/decryption routine (The F5 BIG-IP product family uses specialized hardware built for SSL acceleration to remove processing bottlenecks and encrypt data without having to change application code).

     

    Each BIG-IP system is licensed to provide a maximum number of SSL TPS. A BIG-IP system's SSL TPS can be limited by one of two elements:

     

    • A TPS limit that is specified in the /config/bigip.license file. This limit applies to each instance of the Traffic Management Microkernel (TMM) for non-chassis systems and each blade for VIPRION systems.
    • The system's hardware limitation. In this case, the /config/bigip.license file will specify Unlimited.

    But in all case you can offload SSL without LTM or with LTM...

     

    https://support.f5.com/csp/article/K6475

     

    regards