Forum Discussion

Altocumulus

Jun 05, 2023

SSL Offloading for specific IPs or range of IPs

Current flow is as below Client -> F5 LTM (SSL Proxying) -> On premise Application Servers (TLS Offloading). Certificates that do TLS offloading has F5 LTM DNS as CN/SAN. For a migration of my on ...

Jun 05, 2023

Something like this maybe (where offload_ips is a data-group with ip host and ip/mask as specified)

when CLIENT_ACCEPTED priority 500 {
    if {[class match -- [IP::client_addr] equals offload_ips]} {
        SSL::enable
        pool new_stack_cloud_application
    } else {
        SSL::disable
        pool on_premise_applications_servers
    }
}

Daniel_Wolf
Jun 06, 2023
JRahm, I beg to differ and offer a different solution. Not every problem requires an iRule to be solved. 🙂
I'd rather create two virtual servers, one with pool_A and SSL Bridging configured and another one with pool_B and SSL Passthrough, and make use of K14800: Order of precedence for virtual server matching.
Order Destination Source Port
1 (host address) (network address) (port)
2 (host address) * (port)
For the source you can use an Address List as described in this Manual article: Configuring Multiple IP Addresses and Service Ports for a Virtual Server. This would replace the datagroup for matching the source IP address(es).
KR
Daniel

JRahm

Admin

Jun 05, 2023

Something like this maybe (where offload_ips is a data-group with ip host and ip/mask as specified)

when CLIENT_ACCEPTED priority 500 {
    if {[class match -- [IP::client_addr] equals offload_ips]} {
        SSL::enable
        pool new_stack_cloud_application
    } else {
        SSL::disable
        pool on_premise_applications_servers
    }
}

Daniel_Wolf
MVP
Jun 06, 2023
JRahm, I beg to differ and offer a different solution. Not every problem requires an iRule to be solved. 🙂
I'd rather create two virtual servers, one with pool_A and SSL Bridging configured and another one with pool_B and SSL Passthrough, and make use of K14800: Order of precedence for virtual server matching.
Order Destination Source Port
1 (host address) (network address) (port)
2 (host address) * (port)
For the source you can use an Address List as described in this Manual article: Configuring Multiple IP Addresses and Service Ports for a Virtual Server. This would replace the datagroup for matching the source IP address(es).
KR
Daniel
- JRahm
  Admin
  Jun 06, 2023
  Daniel_Wolf HOW DARE YOU BEG TO DIFFER!! 😎
  
  But seriously, 💯 on only using iRules where necessary. maadavan, this solution is definitely the way to go!
  - Daniel_Wolf
    MVP
    Jun 06, 2023
    I'm always looking for trouble... 😁😁😁
- maadavan
  Altocumulus
  Jun 06, 2023
  Hi Daniel,
  Thanks for additional solution. Will weigh out this approach as well. But here for each phase of migration, when I need to add client IP / Inbound Source IP address, I need to make changes in Virtual Server Config which is bit risky isn't it? With iRules, I would need to edit "offload_ips" data group alone. Something similar to config management.
  - Daniel_Wolf
    MVP
    Jun 06, 2023
    Hi maadavan,
    you would either have to add the IP addresses to the datagroup or to the access list, but not to the virtual server directly. So it is equally risky. Not risky at all, in my opinion.
    KR
    Daniel
maadavan
Altocumulus
Jun 05, 2023
Thanks JRahm, this helps!
- JRahm
  Admin
  Jun 05, 2023
  untested...make sure to test in a lab! if you have trouble I might be able to mock up tomorrow.
  - maadavan
    Altocumulus
    Jun 05, 2023
    Unfortunately I dont own F5 LTM environment to test it. So would be passing across your solution to them. Would let you know in case of any issues during implementation. Thanks much.