Forum Discussion

John_Survant_45's avatar
John_Survant_45
Icon for Nimbostratus rankNimbostratus
Nov 06, 2008

Fields available for lbs decision of https encrpted traffic

We do not use the F5 to terminate SSL but rather do this on the Webservers. This is creating a problem because I can not make a load balancing decision based on URI path because the traffic is encrypted. My question is: are there any alternatives on how we could make Lbs pool decisions with out using the F5 to terminate the SSL session first?

 

 

Basically what fields are available in an Https encrypted traffic that I could use to make a lbs decision?

 

 

I was thinking that the host name could be a possiblity but was not for sure. Any ideas?

 

 

 

application delivery
dev
devops
iRules
  • dennypayne's avatar
    dennypayne
    Icon for Employee rankEmployee
    Nov 06, 2008
    Without terminating you are pretty much stuck with TCP headers. You can't invoke the HTTP_REQUEST event in an iRule to do any decision making on an http element if you don't use an http profile, which requires that you decrypt first. So there's no way to use the hostname either ([HTTP::host] being the operator that you would need).

     

     

    So basically, without terminating SSL you only have the layer 4 info to make a decision with.

     

     

    Denny