How to configure F5 as a reverse proxy

Hi mohammadhuq ,

First, as your external site will be running on https, you need to do SSL offloading on the F5 vServer. For this, you need to have CA signed certificate for your FQDN i.e. abc.com and you need to configure client ssl profile which will have this certificate & it’s associated key and at the end, this client-ssl profile will be mapped to the vServer.

With this, all the incoming requests from the client to the F5 will be encrypted. F5 vServer will decrypt it and then forward request to the backend app servers. 

For redirecting requests based on the URI, you can achieve this requirement using iRule as well as LTM policies.

Below is one sample iRule which is for your use case.

when HTTP_REQUEST {
  if { [HTTP::uri] starts_with "/sales" }{
    pool pool-sales
  } elseif { [HTTP::uri] starts_with "/marketing" }{
    pool pool-marketing
  } 
} 

 There are some other important settings on the vServer that you need to consider.

1. SNAT settings 

2. SSL Profiles

Hope it helps!

Hello Mohammed,

Rewrite profile is not mandatory when passing the traffic through the F5. you can just create LTM objects as you mentioned Node, Pool, and virtual server for each application. Then, make the required change on the hop before the the F5. (for example make a destination NAT on the firewall before that F5 to forward traffic to the virtual server IPs).

And as mayur mentioned, don't forget to make a source address translation in the virtual server settings to avoid any assymetric routing issues.

Everything should work smoothly even if you didn't make any SSL offloading. but in case you will need to make any conditions on the URIs or modifying any HTTP headers or assigning an ASM security policy, you will need to use client SSL and import both certificate and key on F5.

Hi mohammadhuq 

If you want to decrypt traffic on the F5 vServer then you need to configure SSL profiles on the vServer.

In case, if your vServer is on https and backend server is running non-secured port ( e.g. http) then you need to configure only client ssl profile.

In case your vServer as well as backend server is running on secured port e.g. 443, then you need to configure client as well as server ssl profile so vServer can decrypt & encrypt both side connection flows.

To know about SSL profiles, please refer below articles.

Client SSL Profile 

Server SSL Profile 

Hope it helps!