Forum Discussion
Sushant
Altostratus
AltostratusHTTP Profile
Is it mandatory to have SSL Profile if I have selected HTTP as my profile and on top of that selected virtual server standard type ?
Hello Sushant.
AWAF is able to protect web portal because it interprets and analyzes HTTP traffic searching for potential attacks. So, configuring a HTTP profile is mandatory. That means that you have to be able to interpret the whole set of OSI layers (from L4 to L7).
First question you have to ask you is:
Is my backend server (API server) using TLS?
If the answer is yes, you have to put a server SSL profile in your VS.
Second question is:
Do I want to use TLS in my front-side communication for the VS?
If the answer is yes, so I also need to put a client SSL profile in my VS.
Remember that without SSL profiles, F5 won't be able to decrypt that trafffic and without decrypting it there is no WAF protection possible.
Regards,
Dario.
Hello Sushant.
Actually, you can select each profile independently. But if your communication has TLS it will fail.
You should understand the F5 profiles as OSI layers that are interpreted by the device. So, you cannot understand HTTP layer (with an HTTP profile) if you didn't decrypt your flow first (with a SSL Profile).
Regards,
Dario.
SushantHello Dario,
Thank you for the reply .Lets take an example. I have selected Standard Virtual server with L4 profile as TCP and Application profile as HTTP both on the client and server side. In this case I have not used SSL profile but tend to open my application directly using public IP ...shouldn't it work ? in my case it is not working.....
The real scenario is I have an API that communicates with a public IP directly not with any specific domain and my API also directly has an IP with no domain associated. I would like to use AWAF, DOS, Bot profile with it and as you are well aware AWAF,DOS and BOT profile doesn't work until we associate HTTP profile with it .In the case of standard virtual server, I came to find out that if I use HTTP as my profile it is compulsory to use SSL profile otherwise it simply wont work. In my case there is no SSL profile. So, how can i make my security profile working without using HTTP profile ?
Hello Sushant.
AWAF is able to protect web portal because it interprets and analyzes HTTP traffic searching for potential attacks. So, configuring a HTTP profile is mandatory. That means that you have to be able to interpret the whole set of OSI layers (from L4 to L7).
First question you have to ask you is:
Is my backend server (API server) using TLS?
If the answer is yes, you have to put a server SSL profile in your VS.
Second question is:
Do I want to use TLS in my front-side communication for the VS?
If the answer is yes, so I also need to put a client SSL profile in my VS.
Remember that without SSL profiles, F5 won't be able to decrypt that trafffic and without decrypting it there is no WAF protection possible.
Regards,
Dario.
- Sushant
Hello Dario,
Thank you replying back...
Yes I did get your point and in order to use TLS as per my understanding a domain name must be there with their associated DNS record. But in my particular case API has only IP associated (no domain) with it which communicates using a layer2 MPLS link that means there wont be any domain associated with it as there will direct communication using IP over MPLS.
The API is plainly working on HTTP as well so SSL profile is not required as well.
Is there any workaround for these kind of scenarios where I could be using all security profiles ?
Hello Sushant.
I guess you are mixing concepts.
TLS has different features:
- Authentication
- Key Exchange
- Encryption
- Integrity
REF - https://youtu.be/ZM3tXhPV8v0
And you require a domain name and a DNS entry just for the authentication step, which is not related with the encryption step.
Said that, you have two chances:
- Enabling WAF protection: TCP, SSL and HTTP profiles are required
- Not enabling WAF protection: just the TCP profile is required.
Regards,
Dario.
