For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

MarG's avatar
MarG
Icon for Altostratus rankAltostratus
Jun 17, 2020

LTM Healt monitor decrypt ECDHE

Is any method to decrypt LTM HealtMonitor from tcpdump that is using TLS1.2 and Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ? iRule is not an option, because HealtMonitor is not traversing ...
application delivery
LTM
security
boneyard's avatar
boneyard
Icon for MVP rankMVP
Jun 22, 2020

the only way would be for the client (F5) or server (server) to output the session key.

 

for a health monitor im not aware of any way to make that happen, perhaps the server wants to?

 

my question is why? you can easily replicate the behaviour with a curl or openssl s_client from the big-ip, why does the health monitor traffic have to decrypted?

 

 

MarG's avatar
MarG
Icon for Altostratus rankAltostratus
Jun 23, 2020

Thank you for reply. Thats the case.

 

cURL in F5 bash is working and converted to http healt monitor is not responding but that's another case