Forum Discussion

Ben_Levin_9028's avatar
Ben_Levin_9028
Icon for Nimbostratus rankNimbostratus
Jan 04, 2017

HSTS on LTM

We are running 11.5.4 on several BIG IPs and want to implement HSTS. I understand the concept of using an iRule or a policy but I have a question. If our member web servers are doing HTTP only and S...
application delivery
hsts
LTM
security
ssl termination
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Jan 04, 2017

Aside from enabling HSTS on the BIGIP and seeing if anything breaks, are there other ways to mitigate this before enabling HSTS?

 

Sure. If the only HTTP you (believe you) have is the redirects to HTTPS, open a wire capture and filter on HTTP responses other than 301/302. If you see any, then there's probably something dishing out HTTP responses that shouldn't be.

 

You also only want to enable HSTS on the HTTPS VIPs.