Forum Discussion
SSL Bridging verification
- Sep 19, 2023
socvirgin23 The best way to verify this is to perform a tcpdump for the virtual server in question. You can be 99% certain that if you have SSL termination on the F5 and then re-encrypting when you send it to the pool member then that is what the F5 is doing. You should be able to use the following tcpdump on the F5 to save the capture and then open it up in wireshark and verify that the traffic is indeed encrypted.
tcpdump -nni 0.0:nnp <virtual_server_IP> -w /shared/tmp/mycap.pcap
The capture above will save itself to /shared/tmp/ as filename mycap.pcap so once you end the tcpdump that file should have all the data that you're looking for, provided that you tested that specific virtual server when you had the capture running. You should see two connection one between the client and the F5 and then another between the F5 and the pool member. You can track the tcp connection by looking for the ephemeral port that the client used because the F5 does its best to reuse that ephemeral port between itself and the pool member when forming that side of the tcp connection.
socvirgin23 The best way to verify this is to perform a tcpdump for the virtual server in question. You can be 99% certain that if you have SSL termination on the F5 and then re-encrypting when you send it to the pool member then that is what the F5 is doing. You should be able to use the following tcpdump on the F5 to save the capture and then open it up in wireshark and verify that the traffic is indeed encrypted.
tcpdump -nni 0.0:nnp <virtual_server_IP> -w /shared/tmp/mycap.pcap
The capture above will save itself to /shared/tmp/ as filename mycap.pcap so once you end the tcpdump that file should have all the data that you're looking for, provided that you tested that specific virtual server when you had the capture running. You should see two connection one between the client and the F5 and then another between the F5 and the pool member. You can track the tcp connection by looking for the ephemeral port that the client used because the F5 does its best to reuse that ephemeral port between itself and the pool member when forming that side of the tcp connection.
- socvirgin23Sep 19, 2023Altostratus
Thanks Paulius that is a much simpler tcpdump command and explanation than I got from F5 support. I'll give that a go 🙂
- Amr_AliSep 19, 2023MVP
socvirgin23 you can check also this video, it will give you more explanation about SSL bridging, offloading, and passthrough
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com