Forum Discussion

Nimbostratus

Aug 17, 2022

F5 SSL-O service chaining issue

Dear F5 Expert, I just implement SSL-O offload in Explicit proxy topologies and off-load SWG in explicit proxy mode. I found the issue detail as below. Security policy Catagorie lookup ALL (Pinne...

application delivery

security

Kirimaya

Nimbostratus

Dear Kevin

But i don't understand, why i juse classification by source IP and bypass ssl. It can be sent to SWG

Nikoolayy1

MVP

Aug 26, 2022

Also I forgot to mention that if you have URL database the SSLO can also do a URL lookup based on CN or SNI without SSL decryption and you can then forward those sites to the the proxy with a service as mentioned that is not HTTP or ICAP. You can also create a custom categories without license. Also you should be able to use the category lookup as a condition rule without directly changing that Per-Request Policy as the Guided config will change it.

Category lookup

https://techdocs.f5.com/en-us/bigip-15-0-0/big-ip-access-policy-manager-visual-policy-editor/per-request-policy-item-reference/about-per-request-classification-items/about-category-lookup.html

An example:

https://techdocs.f5.com/en-us/bigip-16-0-0/ssl-orchestrator-setup/terminology-for-herculon-ssl-orchestrator-ct.html