Forum Discussion
Poseidon1974
Cirrostratus
CirrostratusPersistence session
Hi all , I am new in the F5 administration, I share my configuration here, I hope someone can help me, I have configured a VS as standard, with a persistence session (JSESSION), via an iRule, howeve...
Poseidon1974Cirrostratus
CirrostratusHi ,
Thanks for your reply , just to confirm , in this kind of configuration , which profile we should configure :
- http_XFF
or
- http_XFF_HSTS
Thanks,
Hi,
Just for a little clarity if it helps, if you want to add the xff header to your http header.
Then this is set in the http profile.
its just a tick box you need to enable, either in the base profile but even better would be to make a new on with the base http profile as the parent and then add the xff header to that.
Also you meantion certificates on the back end.
So, you can have the cert from the server also on your f5 at the front end dependant on your use case.
But you can also have it encrypted on the front end "client ssl" and have no cert on the back end server.
This would then make the flow from the f5 to the backend server unencrypted.
Which is fine, but you may need to talk to your security or architectual teams just to make sure they are happy with that. It will all depend on your security/risk posture and the network design.
- Poseidon1974
Hi ,
Thank you for this detailed answer, however my need is to know, how to make session persistence work, obviously as long as the certificate is on the server and not on the F5, it will not work. because the traffic will not be decrypted by the F5. you tell me, i can export the certificate currently configured on the server to the F5? how ?
Thanks,
mihaicMVP
First, you need to make the VIP decrypt the traffic. So you need an SSL certificate to terminate the HTTPS sessions on the VIP side.
After that, you will need an irule. Here is an example:
The following iRule example illustrates how the BIG-IP system can find a cookie called jsessionid in the first response from the server and add a persistence record with the value of that cookie. Subsequent client requests containing the same cookie name and value pair persists to the same pool member. when HTTP_RESPONSE { if { [HTTP::cookie exists "JSESSIONID"] } { persist add uie [HTTP::cookie "JSESSIONID"] } } when HTTP_REQUEST { if { [HTTP::cookie exists "JSESSIONID"] } { persist uie [HTTP::cookie "JSESSIONID"] } }https://support.f5.com/csp/article/K7392
If you need the traffic to the server from the F5 to be also encrypted you will need an SSL server profile.
https://support.f5.com/csp/article/K14806
here is how to export a SSL cert:
here is how to import it:
https://my.f5.com/manage/s/article/K14620
- Poseidon1974
Hi ,
many thansk !!!