SSL Offloading

You can do it one of two ways:

1. You can simply pass the 443 SSL traffic through the box - remove an client or server SSL profiles, set the VIP to listen on port 443, send to a pool of servers listening on port 443, and remove any layer 7 profiles from the VIP (ie. HTTP).

    

2. You can terminate and re-encrypt the SSL on the LTM. This will require a client AND server SSL profile. The great things about this options are 1) you can see inside the payload and make decisions, like persistence and request routing, and 2) you'll generally get much higher throughput if you let hardware offload the SSL. Granted that's mostly negated when you re-encrypt, but then there's a good argument for not re-encrypting, or at least re-encrypting at a lower cipher strength.