For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

3 Replies

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Apr 21, 2014

    HTTP filtering is an OSI layer 7 process, while SSL is a layer 6 process. As long as an SSL profile is applied to decrypt the client side traffic, the HTTP events and commands are independent of layer 6 processing. In other words, you HTTP iRule should work exactly the same - assuming you're offloading SSL with a client SSL profile.

     

  • kend's avatar
    kend
    Icon for Altostratus rankAltostratus
    Apr 21, 2014

    If I want to use a server SSL profile, how would I make that work?

     

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Apr 21, 2014

    It still doesn't matter. If you think of the proxy in terms of OSI layers, it might look like this:

    Client  ->  L4 TCP -> L5/6 SSL -> L7 HTTP -> L6/5 SSL -> L4 TCP  ->  Server

    HTTP layer 7 sits between the client side SSL and server side SSL. If you decrypt SSL on the client side, the HTTP traffic will be accessible to the HTTP filter. Whether or not you re-encrypt on the server side doesn't matter, because by that point in the proxy you've already left layer 7.