LTM SSL Offloading

Question

Dears,
I have an application server  that uses http port 80 , this server is installed behind an F5 LTM and IPS
we are now requested to encrypt the traffic going to the server using SSL offloading , the traffic from the clients to the F5 should be encrypted using an SSL client profile and the traffic between the F5 and the server needs to be sent as clear text to make sure that the IPS can read it.&nbsp;
my question is:
 i created a VS on the F5 that listens to HTTPS and i uploaded the certificates and assigned them to an SSL client profile and we kept the physical server listening to HTTP (port 80) but that didn't work , ( i always get a blank page as a response from the server).&nbsp;
will the LTM by default change the  request comes to tcp 443 to tcp 80 on the server side or not ? do i need to change anything?&nbsp;
Best regards,
Ahmad&nbsp;

ahmad_mohaidat_ · Answer

Thanks for your response , kindly note that when i install the certificates on the physical server and bypass the F5 , i can login to the server without any issues &nbsp;
here is an SSLsump 172.32.31.200 is the IP address of the virtual server and 10.255.155.137 is my IP. , .&nbsp;
[root@EMP-LTMASM-1:Active:In Sync] tmp  ssldump -nr /var/tmp/www-ssl-client.cap&nbsp;
New TCP connection 2: 10.255.155.137(50487) &lt;-&gt; 172.32.31.200(443)&nbsp;
New TCP connection 1: 10.255.155.137(50488) &lt;-&gt; 172.32.31.200(443)&nbsp;
1 1  0.0041 (0.0041)  C&gt;S  Handshake&nbsp;
      ClientHello&nbsp;
        Version 3.3&nbsp;
        cipher suites&nbsp;
        TLS_RSA_WITH_AES_128_CBC_SHA256&nbsp;
        TLS_RSA_WITH_AES_128_CBC_SHA&nbsp;
        TLS_RSA_WITH_AES_256_CBC_SHA256&nbsp;
        TLS_RSA_WITH_AES_256_CBC_SHA&nbsp;
        TLS_RSA_WITH_RC4_128_SHA&nbsp;
        TLS_RSA_WITH_3DES_EDE_CBC_SHA&nbsp;
        Unknown value 0xc027&nbsp;
        Unknown value 0xc013&nbsp;
        Unknown value 0xc014&nbsp;
        Unknown value 0xc02b&nbsp;
        Unknown value 0xc023&nbsp;
        Unknown value 0xc02c&nbsp;
        Unknown value 0xc024&nbsp;
        Unknown value 0xc009&nbsp;
        Unknown value 0xc00a&nbsp;
        TLS_DHE_DSS_WITH_AES_128_CBC_SHA256&nbsp;
        TLS_DHE_DSS_WITH_AES_128_CBC_SHA&nbsp;
        TLS_DHE_DSS_WITH_AES_256_CBC_SHA256&nbsp;
        TLS_DHE_DSS_WITH_AES_256_CBC_SHA&nbsp;
        TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA&nbsp;
        TLS_RSA_WITH_RC4_128_MD5&nbsp;
        compression methods&nbsp;
                  NULL&nbsp;
1 2  0.0042 (0.0000)  S&gt;C  Alert&nbsp;
    level           fatal&nbsp;
    value           handshake_failure&nbsp;
1    0.0042 (0.0000)  S&gt;C  TCP FIN&nbsp;
2 1  0.0048 (0.0048)  C&gt;S  Handshake&nbsp;
      ClientHello&nbsp;
        Version 3.3&nbsp;
        cipher suites&nbsp;
        TLS_RSA_WITH_AES_128_CBC_SHA256&nbsp;
        TLS_RSA_WITH_AES_128_CBC_SHA&nbsp;
        TLS_RSA_WITH_AES_256_CBC_SHA256&nbsp;
        TLS_RSA_WITH_AES_256_CBC_SHA&nbsp;
        TLS_RSA_WITH_RC4_128_SHA&nbsp;
        TLS_RSA_WITH_3DES_EDE_CBC_SHA&nbsp;
        Unknown value 0xc027&nbsp;
        Unknown value 0xc013&nbsp;
        Unknown value 0xc014&nbsp;
        Unknown value 0xc02b&nbsp;
        Unknown value 0xc023&nbsp;
        Unknown value 0xc02c&nbsp;
        Unknown value 0xc024&nbsp;
        Unknown value 0xc009&nbsp;
        Unknown value 0xc00a&nbsp;
        TLS_DHE_DSS_WITH_AES_128_CBC_SHA256&nbsp;
        TLS_DHE_DSS_WITH_AES_128_CBC_SHA&nbsp;
        TLS_DHE_DSS_WITH_AES_256_CBC_SHA256&nbsp;
        TLS_DHE_DSS_WITH_AES_256_CBC_SHA&nbsp;
        TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA&nbsp;
        TLS_RSA_WITH_RC4_128_MD5&nbsp;
        compression methods&nbsp;
                  NULL&nbsp;
2 2  0.0049 (0.0000)  S&gt;C  Alert&nbsp;
    level           fatal&nbsp;
    value           handshake_failure&nbsp;
2    0.0049 (0.0000)  S&gt;C  TCP FIN&nbsp;
1    0.0060 (0.0018)  C&gt;S  TCP FIN&nbsp;
2    0.0069 (0.0019)  C&gt;S  TCP FIN&nbsp;
New TCP connection 3: 10.255.155.137(50489) &lt;-&gt; 172.32.31.200(443)&nbsp;
New TCP connection 4: 10.255.155.137(50490) &lt;-&gt; 172.32.31.200(443)&nbsp;
3 1  0.0034 (0.0034)  C&gt;S SSLv2 compatible client hello&nbsp;
  Version 3.1&nbsp;
  cipher suites&nbsp;
  TLS_RSA_WITH_AES_128_CBC_SHA&nbsp;
  TLS_RSA_WITH_AES_256_CBC_SHA&nbsp;
  TLS_RSA_WITH_RC4_128_SHA&nbsp;
  TLS_RSA_WITH_3DES_EDE_CBC_SHA&nbsp;
  Unknown value 0xc013&nbsp;
  Unknown value 0xc014&nbsp;
  Unknown value 0xc009&nbsp;
  Unknown value 0xc00a&nbsp;
  TLS_DHE_DSS_WITH_AES_128_CBC_SHA&nbsp;
  TLS_DHE_DSS_WITH_AES_256_CBC_SHA&nbsp;
  TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA&nbsp;
  TLS_RSA_WITH_RC4_128_MD5&nbsp;
  SSL2_CK_RC4&nbsp;
  SSL2_CK_3DES&nbsp;
  Unknown value 0xff&nbsp;
3 2  0.0035 (0.0000)  S&gt;C  Alert&nbsp;
    level           fatal&nbsp;
    value           handshake_failure&nbsp;
3    0.0035 (0.0000)  S&gt;C  TCP FIN &nbsp;
4 1  0.0034 (0.0034)  C&gt;S SSLv2 compatible client hello&nbsp;
  Version 3.1&nbsp;
  cipher suites&nbsp;
  TLS_RSA_WITH_AES_128_CBC_SHA&nbsp;
  TLS_RSA_WITH_AES_256_CBC_SHA&nbsp;
  TLS_RSA_WITH_RC4_128_SHA&nbsp;
  TLS_RSA_WITH_3DES_EDE_CBC_SHA 
  Unknown value 0xc013&nbsp;
  Unknown value 0xc014&nbsp;
  Unknown value 0xc009&nbsp;
  Unknown value 0xc00a&nbsp;
  TLS_DHE_DSS_WITH_AES_1 28_CBC_SHA&nbsp;
  TLS_DHE_DSS_WITH_AES_256_CBC_SHA&nbsp;
  TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA&nbsp;
  TLS_RSA_WITH_RC4_128_MD5&nbsp;
  SSL2_CK_RC4&nbsp;
  SSL2_CK_3DES&nbsp;
  Unknown value 0xff&nbsp;
4 2  0.0034 (0.0000)  S&gt;C  Alert&nbsp;
    level           fatal&nbsp;
    value           handshake_failure&nbsp;
4    0.0034 (0.0000)  S&gt;C  TCP FIN&nbsp;
3    0.0053 (0.0018)  C&gt;S  TCP FIN&nbsp;
4    0.0051 (0.0016)  C&gt;S  TCP FIN&nbsp;
New TCP connection 5: 10.255.155.137(50491) &lt;-&gt; 172.32.31.200(443)&nbsp;
New TCP connection 6: 10.255.155.137(50492) &lt;-&gt; 172.32.31.200(443)&nbsp;
5 1  0.0032 (0.0032)  C&gt;S SSLv2 compatible client hello&nbsp;
  Version 3.0&nbsp;
  cipher suites&nbsp;
  SSL_RSA_WITH_RC4_128_SHA&nbsp;
  SSL_RSA_WITH_3DES_EDE_CBC_SHA&nbsp;
  SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA&nbsp;
  SSL_RSA_WITH_RC4_128_MD5&nbsp;
  SSL2_CK_RC4&nbsp;
  SSL2_CK_3DES&nbsp;
  Unknown value 0xff&nbsp;
5 2  0.0032 (0.0000)  S&gt;C  Alert&nbsp;
    level           fatal&nbsp;
    value           handshake_failure&nbsp;
5    0.0033 (0.0000)  S&gt;C  TCP FIN&nbsp;
6 1  0.0033 (0.0033)  C&gt;S SSLv2 compatible client hello&nbsp;
  Version 3.0&nbsp;
  cipher suites&nbsp;
  SSL_RSA_WITH_RC4_128_SHA&nbsp;
  SSL_RSA_WITH_3DES_EDE_CBC_SHA&nbsp;
  SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA&nbsp;
  SSL_RSA_WITH_RC4_128_MD5&nbsp;
  SSL2_CK_RC4&nbsp;
  SSL2_CK_3DES&nbsp;
  Unknown value 0xff&nbsp;
6 2  0.0034 (0.0000)  S&gt;C  Alert&nbsp;
    level           fatal&nbsp;
    value           handshake_failure&nbsp;
6    0.0034 (0.0000)  S&gt;C  TCP FIN&nbsp;
5    0.0052 (0.0019)  C&gt;S  TCP FIN&nbsp;
6    0.0050 (0.0016)  C&gt;S  TCP FIN&nbsp;
New TCP connection 8: 10.255.155.137(50494) &lt;-&gt; 172.32.31.200(443)&nbsp;
New TCP connection 7: 10.255.155.137(50493) &lt;-&gt; 172.32.31.200(443)&nbsp;
Version 2 Client.&nbsp;
8    0.0031 (0.0031)  S&gt;C  TCP FIN&nbsp;
Version 2 Client.&nbsp;
7    0.0043 (0.0043)  S&gt;C  TCP FIN&nbsp;
8    0.0047 (0.0016)  C&gt;S  TCP FIN&nbsp;
7    0.0058 (0.0015)  C&gt;S  TCP FIN  &nbsp;

nitass · Answer

have you tried "clientssl-insecure-compatible" clientssl profile?&nbsp;

emad · Answer

Kind of a suggestion , This goal can also be achieved if you differentiate you DMZ segment from APP segment. Using Router between servers and BigIP LTM can give you ease to send your traffic for internal ASA or IPS/IDS Module.

kevin_stewart · Answer

If I may add, your capture is basically 6 different attempts to start an SSL handshake, starting with TLS1.2 and moving to TLS1.0. The odd thing is that the client's CLIENTHELLO message is met with an immediate failure by the server. This would usually indicate some egregious disparity between the client and server's capabilities. So quick questions then:
Are you doing anything specific in the client SSL profile? Specific cipher selection? Any non-default settings? If you have made changes, what happens if you use a basic unmodified client SSL profile (except for the server cert and key)?
And in case there's something missing from the logs, do you see any server side traffic with a tcpdump?
tcpdump -lnni 0.0 port 80 and host y.y.y.y

where y.y.y.y is the IP address of the web server.

Forum Discussion

LTM SSL Offloading

4 Replies

F5 Architecture Track Sessions - AppWorld 2026

Recent Discussions

2026 301a exam

F5OS login with admin/root failed via console

VIP is not responding on SYN after enabling other modules like ASM, APM and AFM.

UCS Encryption Question

Unblock Request WAF

Related Content

SSL Offloading and Backend pool https

SSL Offload with HTTP/2.0

SSL Offloading for specific IPs or range of IPs

F5 SSL Offload behind Nginx Reverse Proxy

The State Of HTTP/2 With F5 LTM

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS