For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Jason_19901's avatar
Jason_19901
Icon for Nimbostratus rankNimbostratus
Mar 24, 2011

SSL offload to IPS

New to the forum. I am decrypting SSL traffic on the F5 and would like an iRule to send the unencrypted data to an IPS before it gets encrypted again on its way to the node. Is this possible?  
application delivery
dev
devops
iRules
Steve_Brown_882's avatar
Steve_Brown_882
Historic F5 Account
Mar 25, 2011
Another interesting option I have seen tested to solve this issue actually involves using 2 different route domains on the LTM. Basically there is a front side route domain and a back side route domain with the IPS in the middle processing traffic transparently.

 

 

Here is an exampl

 

 

Route Domain 1 Transparent Route Domain 2

 

VS(1.2.3.4)clientSSL --> Pool(192.168.100.100 and 192.168.100.101) --> IPS --> VS(forwarding VS)w/serverSSL

 

 

 

Traffic passes through the VS in RD1 and is decrypted with a client SSL profile and sent to pool members in the clear. In order to reach the pool it has to exit the interface in the 192.168.100.0(RD1) vlan which is directly connected to the IPS. The IPS is then connected to a l2 only VLAN in RD2. This VLAN is set to bridge all traffic to the 192.168.100(RD2) vlan which has a forwarding VS that has a server SSL profile applied to re-encrypt to the back end.

 

 

This is somewhat simplified version of it and I may not be explaining it perfectly but it would do the job for sure. Clone pools may be an easier option if they work in you situation.