https end to end
Hi,
We are looking at solution to use f5 as load balance with a few IIS webServer sitting behind as target pool. IIS webServers are in private network, while LB will be internet facing (therefore LB will have public IP). The public URL/FQDN to internet is https, and we want f5 could passthrough/proxy to our backend webServers via https as well. We have strong need to have our webServer application only serving https due to company policy. Could someone explain which solution/configuration we could use to meet this requirement.
Speically about the ssl/tls certificates, would be possible to use self-signed certificate between LB and backend webServer, while only buy certificate for LB for https between end user and LB?
I am quite new to f5, would be highly appreciated if someone could provide some reference design/configuration.
Regards!
If your company security policy does not allow F5 to decrypt and re-encrypt the traffic before sending it to the backend servers, then you will need to configure SSL and the certifications on the backend server itself as there will be no SSL sessions between F5 and the server (pass-through scenario, see here: https://support.f5.com/csp/article/K65271370), in other words F5 will not participate in the SSL process.
However, the number of certificates you need is not relative to which scenario you are using, as it depends on the number of domains you are publishing not on the number of servers you are using, e.g if your domain is www.example.com and it's served by five servers then you only need to buy one cert and deploy it to the five servers if using the pass-through setup. But if SSL is terminated on F5 you'll only need to deploy the cert on F5 and use self-signed certs between F5 and the five servers.
Hop that helps