SNI

Set up VIP targetted VIP and use a traffic policy.

 

First VIP listens on 443 and had has no ssl profiles, snat or http profile. It only has a local traffic policy.

 

This policy will forward traffic to a targetted vip (1 vip per client ssl profile) based on the SNI name in the TLS client hello.

 

 

Per targetted VS you have a client ssl profile with the correct certificate and ciphers, http profile.

 

Some useful resources:

 

https://devcentral.f5.com/articles/lightboard-lessons-vip-targeting-vip

 

https://devcentral.f5.com/articles/sni-routing-with-big-ip-31348

 

Hi K-Dubb,

you have to read the SNI value on the TCP layer by using the

TCP::collect

and

TCP::payload

commands before the

CLIENTSSL_CLIENTHELLO

event gets processed. By doing so you will be able to manually

SSL::profile XYZ

choose a non-sni-aware SSL profile as you like.

Depending on the detailed requirements it may be sufficient to check if the first collected

TCP::payload

is

contain

included in given Data-Group. The Data-Group key would be the SNI name and the Data-Group value would be the SSL Profile to become selected. If this approach is not sufficient for your solution, you would need to binary parse the received CLIENTHELLO payload to extract the SNI value more accurately...

Check out Joels SNI parsing iRule to get an idea how to parse the SNI value...

https://devcentral.f5.com/codeshare/tls-server-name-indication

Cheers, Kai

What if instead of trying to do a different profile, I used the existing profile/VIP and wrote a policy to reset traffic if a certain protocol is used for a certain server name? Basically:

Match all the following conditions
SSL Extension server name is abc.domain.com at ssl client hello
client ssl protocol is SSLv3 at request time
Do the following:
Reset traffic

So if a request comes in for abc.domain.com attempting with SSLv3, reset it. All other hosts would be allowed. Thoughts?

Edit: I might have to use HTTP Host instead if the protocol does not support SNI.

Edit 2: I did test this and it does reset the connection once there is a GET request. It does however still show up in an SSL Scan as expected.