For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Singh_74932's avatar
Singh_74932
Icon for Nimbostratus rankNimbostratus
Sep 14, 2009

ssl - profile

Here is what i want to do :     We have SNAT pool configured on our big ip so i use "X-forward-for" http header to log actaul client ip in web server. Now i want to do it for HTTPS.   ...
management
monitoring
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Sep 15, 2009
Hi Singh,

 

 

If you want to decrypt the client to VIP SSL, you would import the cert/key and create a client SSL profile. If you want to re-encrypt the SSL on the server side, you would use a server SSL profile. You would only need to import a cert/key for the server SSL profile if the server(s) require a client cert for SSL handshakes.

 

 

Once you add a client SSL profile, LTM will decrypt all SSL. Nothing at the HTTP layer is changed after the SSL decryption is done. LTM does not act as an HTTP proxy to tunnel SSL with the CONNECT method.

 

 

Once you add a client SSL profile to the VIP, you can also add an HTTP profile. You can enable the XFF option on the HTTP profile to have LTM insert the original client IP address in the XFF header.

 

 

Aaron