Forum Discussion

mikand_61525's avatar
mikand_61525
Icon for Nimbostratus rankNimbostratus
Jan 10, 2012

Using ASM in a forward-http proxy scenario?

Usually the ASM is used in reverse proxy scenarios (protected your own webservers) - but have anyone in here used ASM in a forward http proxy scenario to protect the clients (and to make sure your cli...
app sec
BIG-IP Access Policy Manager (APM)
security
mikand_61525's avatar
mikand_61525
Icon for Nimbostratus rankNimbostratus
Jan 13, 2012
It seems that settng a http profile and later a http class (to connect to the ASM) works fine in the VS_FORWARD-HTTP but not for the VS_FORWARD-HTTPS.

 

 

It seems that the http profile doesnt support CONNECT which is the command used in "SSL Proxy" situations (SSL Proxy is the setting used in the webbrowser which is pointed towards the ip:port for the VS_FORWARD-HTTPS). Since http profile doesnt work it also means that the http class (which connects to ASM) doesnt work either along with analytics (AVR) :-(

 

 

Any ideas on how to modify the http profile so it will support CONNECT?

 

 

The effect is that the F5 sends FIN-ACK as soon as it gets a CONNECT cmd (and not forward the traffic to the https-proxy server).

 

 

The difference between the two cases (regarding what the client sends):

 

 

forward http-proxy:

 

 

GET http://www.example.com:80/

 

 

forward https-proxy:

 

 

CONNECT https://www.example.com:443/