For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

2 Replies

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Jul 22, 2014

    A typical best practice for SSL VPN connectivity is:

    Protocol Profile (Client): tcp-wan-optimized
Protocol profile (Server): tcp-lan-optimized

    You can optionally enable any of the wam or wom optimized profiles, depending on your environment. In any case, you should see a significant difference in performance.

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Jul 23, 2014

    It's difficult to say in a few sentences what a "best practice" is, given varying scenarios. The out-of-the-box LAN and WAN profiles are highly tuned. The WAN an WOM profiles are also very good, and if you actually have WA or WOM (no AAM) licensed, then there's even more you can do to optimize the traffic.

     

    SNAT is useful in the SSL VPN the same way it is in a typical VIP environment. It's used to force return routing when there's a chance that servers can respond around the BIG-IP. I believe it's enabled by default when you run the network access wizard, so it's probably better to use it than to not use it, but again it depends on your environment.