SSL offload to IPS

You might want to investigate utilizing Clone Pools to see if it will do what you are needing.

 

 

SOL8573: Overview of port mirroring and clone pools

 

http://support.f5.com/kb/en-us/solutions/public/8000/500/sol8573.html?sr=13486642

 

 

Clone Pools can be configured to capture one way or two way traffic (Traffic to the Server from the Client - Clone Pool (Client) and traffic to the Client from the Server - Clone Pool (Server)). It does this during SSL tear down if the traffic is encrypted.

Agreed. Cloning the traffic is going to be far lighter on the systems than not.

 

 

H

Another interesting option I have seen tested to solve this issue actually involves using 2 different route domains on the LTM. Basically there is a front side route domain and a back side route domain with the IPS in the middle processing traffic transparently.

 

 

Here is an exampl

 

 

Route Domain 1 Transparent Route Domain 2

 

VS(1.2.3.4)clientSSL --> Pool(192.168.100.100 and 192.168.100.101) --> IPS --> VS(forwarding VS)w/serverSSL

 

 

 

Traffic passes through the VS in RD1 and is decrypted with a client SSL profile and sent to pool members in the clear. In order to reach the pool it has to exit the interface in the 192.168.100.0(RD1) vlan which is directly connected to the IPS. The IPS is then connected to a l2 only VLAN in RD2. This VLAN is set to bridge all traffic to the 192.168.100(RD2) vlan which has a forwarding VS that has a server SSL profile applied to re-encrypt to the back end.

 

 

This is somewhat simplified version of it and I may not be explaining it perfectly but it would do the job for sure. Clone pools may be an easier option if they work in you situation.

Easiest way:

1. Virtual Server 1 listens on port 443 and has a clientSSL profile and clone pool but no default pool. It also has an iRule similar to the following:

when HTTP_REQUEST {
     virtual virtual2 }

2. Virtual Server 2 (virtual2) listens on port 80 but has a serverSSL profile. It also has a default pool.

Nice tip Chris, I like it.

 

 

Colin

Any idea if route domains are required? It seems like Chris's example with a VS targeting VS would work fine.

 

Thanks, Aaron