Forum Discussion
Jason_19901
Nimbostratus
NimbostratusSSL offload to IPS
New to the forum. I am decrypting SSL traffic on the F5 and would like an iRule to send the unencrypted data to an IPS before it gets encrypted again on its way to the node. Is this possible?
Another interesting option I have seen tested to solve this issue actually involves using 2 different route domains on the LTM. Basically there is a front side route domain and a back side route domain with the IPS in the middle processing traffic transparently.
Here is an exampl
Route Domain 1 Transparent Route Domain 2
VS(1.2.3.4)clientSSL --> Pool(192.168.100.100 and 192.168.100.101) --> IPS --> VS(forwarding VS)w/serverSSL
Traffic passes through the VS in RD1 and is decrypted with a client SSL profile and sent to pool members in the clear. In order to reach the pool it has to exit the interface in the 192.168.100.0(RD1) vlan which is directly connected to the IPS. The IPS is then connected to a l2 only VLAN in RD2. This VLAN is set to bridge all traffic to the 192.168.100(RD2) vlan which has a forwarding VS that has a server SSL profile applied to re-encrypt to the back end.
This is somewhat simplified version of it and I may not be explaining it perfectly but it would do the job for sure. Clone pools may be an easier option if they work in you situation.