irule with different SSL profiles depending on the pool.

Quick thought, do you have a serverssl profile on the VIP? I understand it's a pre-req for serverssl switching.

 

N

 

Hi Nathan,

 

Yep have serverssl profile on the SSL Profile (Server) on the VIP. Transitioning from ACE modules/Appliances and you could assign different SSL profiles under the Load Balance policies and I'm hoping to do about the same thing.

 

Hi helm123,

 

you can create multiple client-ssl profiles containing specific cert/key combinations and assign them all to the same virtual server.

 

If the client supports SNI (server name indication; an extension available with SSL/TLS) the client provides in the hello an attribute containing the expected common name in the server certificate.

 

This way the virtual server can pick the proper certificate and the client won´t throw an error message due to certificate mismatch.

 

Thanks, Stephan

 

Hi helm123, the typical requirement would be to: - provide the expected certificate to the client during handshake - inspect http-payload (requires established SSL/TLS connection between client and virtual server) - make a forwarding decision (considering persistency) - re-encrypt http-payload before forwarding to selected real server (aka pool member) For SSL/TLS termination between client and virtual server the client-ssl profile(s) is/are relevant. For SSL/TLS communication between load balancer and real server the server-ssl profile(s) is/are relevant. The client-ssl profile(s) contain(s) the server certificate, private key and intermediate CA certificate provided to the client. The server-ssl profile(s) would contain client certificates to be provided to the real server (not required that often). Switching SSL profiles is supported before doing the SSL/TLS handshake, i.e. after the CLIENT_ACCEPTED event is fired (right after 3-way handshake). They cannot be changed, after the SSL/TLS connection was established to send a payload through the encrypted "tunnel". I hope this helps a bit regarding the F5 terminology. :) Thanks, Stephan

Thanks Stephen, Yep this is actually the SSL (2-way) connection from the F5 to the real servers. Actually have a decent number of pools inside the irule that are going to require different cert/key pairs (server ssl profiles) determined by the customers real servers. Started looking at some of the examples that showed the CLIENT_ACCEPTED setup that Google helped me find. Was able to get this irule configuration accepted when I hit update. when CLIENT_ACCEPTED { if { $doSSL == 1 }{ SSL::enable serverside SSL::profile CompanyA } elseif { $doSSL == 2 }{ SSL::enable serverside SSL::profile CompanyB } } when HTTP REQUEST { switch -glob [HTTP::uri] { "/external/lifts/docs" - "/internal/sites" { set doSSL 1 pool CompanyA } "/external/boats/docs" - "/internal/states" { set doSSL 2 pool CompanyB } } }

How about using SERVER_CONNECTED:

When HTTP REQUEST { 
  switch -glob [HTTP::uri] {  
   "/external/lifts/docs" -  
   "/internal/sites" {    
     pool CompanyA  
  }
   "/external/boats/docs" -  
   "/internal/states" { 
      pool CompanyB  
  }
 }
}

when SERVER_CONNECTED { 
  switch [LB::server pool] { 
    CompanyA { 
    SSL::profile CompanyA 
  } 
    CompanyB {
        SSL::profile CompanyB 
  } 
 }  
}

See if that helps, not in front of my lab box to fully test syntax etc...

N

sorry, syntax error:

when HTTP_REQUEST { 
  switch -glob [HTTP::uri] {  
   "/external/lifts/docs" -  
   "/internal/sites" {    
     pool CompanyA  
  }
   "/external/boats/docs" -  
   "/internal/states" { 
      pool CompanyB  
  }
 }
}

when SERVER_CONNECTED { 
  switch [LB::server pool] { 
    CompanyA { 
    SSL::profile CompanyA 
  } 
    CompanyB {
        SSL::profile CompanyB 
  } 
 }  
}

Should have replied back long ago that we got this working with the below.

 

When HTTP REQUEST { switch -glob [HTTP::uri] {

 

"/external/lifts/docs" -

 

"/internal/sites" {

 

pool CompanyA set doSSL 1 } "/external/boats/docs" -

 

"/internal/states" { pool CompanyB set doSSL 2 } } } when SERVER_CONNECTED { if { $doSSL == 1 } { SSL::enable serverside SSL::profile SSL_2Way } elseif { $doSSL == 2 } { SSL::enable serverside SSL::profile SSL_1Way }

 

}

 

Hi Guys,

 

The Irule above is to encrypt the connection that goes to server and the client connection, do you have client ssl profile to decrypt the connection and the Irule to redirect the traffic to different pools, can you show the configuration?