SSL offload headers for ASM

Chris,

 

 

Hmm, so the ASM of course needs the traffic to be decrypted before it can really do much for it (hence the asm policies being for http).

 

 

In a single unit, dual module configuration, typically you just see an LTM virtual with a ssl profile on it, and an ASM enabled HTTP class attached to it. This allows the LTM to do the ssl decrypt and the ASM module to do it's dark magic. You can even throw on a server side SSL profile if you want to re-encrypt.

 

 

In the dual box environment, question:

 

 

are you re-encrypting between the LTM unit and ASM unit? If so, then you should just be able to decrypt on the ASM unit Virtual server profile, and let the ASM do it's thing.

 

 

Sorry for the scattergun answer, I may have misread the question (and there is probably about 10,000 different right answers.

 

 

Josh M

I assume they're not using HTTPS between the LTM and ASM. If that's true, you can force ASM to globally interpret all requests as HTTP using an internal parameter:

 

 

10.2.x - Manual Chapter: Internal Parameters for Advanced Configuration

 

https://support.f5.com/kb/en-us/products/big-ip_asm/manuals/product/config_guide_asm_10_2_0/asm_apx_internal_params.html

 

 

ProtocolIndication - Specifies how the system distinguishes between HTTP and HTTPS URLs. If the value is -1, the system decides whether the object requested is an HTTP request or an HTTPS request based on the incoming traffic. If the value is 0, the system treats all incoming URL requests as HTTP requests. If the value is 1, the system treats all incoming URL requests as HTTPS requests.

 

 

Aaron

Ahh, so there's no header we could insert on the LTM's? Strange, I thought there would've been one. Given that we are ASMing some normal HTTP traffic as well as HTTPS, forcing a presumption on ASM doesn't seem appropriate, especiaily as we might be wanting to enable the internal parameters for secure cookies, as then we'd be setting secure on a non-secure cookie which sounds like a bad place to be!

 

 

Thanks guys, as always!