For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Jim_M's avatar
Jim_M
Icon for Cirrus rankCirrus
Sep 06, 2022

supporting a http2 sni website with f5 ltm?

I have a website which is working fine directly from browser to server. But not via f5 (v16.1.2). The session uses https 443, tls1.2, http2.0, and the server relies on SNI. When via F5, the client b...
application delivery
LTM
AaronJB's avatar
AaronJB
Ret. Employee
Sep 06, 2022

I believe you're on the right lines by including the server name in the server SSL profile, but I think (even if there's only one profile) you have to enable the "serverssl-use-sni" feature on the Virtual Server: https://support.f5.com/csp/article/K39408450

If that isn't working then you could probably pull the SNI field out of the server side connection using iRules and the SSL::extensions command. Kai_Wilke has an example of inserting the SNI header here (which is an alternative for versions earlier than 15.1.x or if you didn't want to use multiple SSL profiles and the serverssl-use-sni featurea) which could be used as the basis to build a rule to extract and log the header instead.