Forum Discussion

Jonathan_c's avatar
Jonathan_c
Icon for Cirrus rankCirrus
Nov 29, 2023

How to force close TLS sessions in a failover scenario

Hi, We have an application behind Big-IP which doesn't handle failovers well. The Big-IP keeps all TLS sessions consistent and open during failover but the application doesn't support TLS resume fo...
application delivery
close session
FAILOVER
ha
security
TLS sessions
Jonathan_c's avatar
Jonathan_c
Icon for Cirrus rankCirrus
Nov 30, 2023

Paulius I do perform SSL termination for client side and also use SSL for server side.

But on both SSL profiles we already have the mirroring feature disabled...

zamroni777 by disabling resume you mean enabling the "Strict Resume" feature in the SSL server side profile?

Do I also do enable it on the client side profile?

  • zamroni777's avatar
    zamroni777
    Icon for Cumulonimbus rankCumulonimbus
    Dec 27, 2023

    plus Session Ticket.
    https://my.f5.com/manage/s/article/K14806

    you can keep resume enabled in client side ssl profile as ltm handled it independently to server side ssl.

    you can create test server ssl profile and use it for test pool.
    then do tcpdump to see the impact of the config to the ssl session setup messages.