Using BIG-IP LTM as a forward proxy, SSL problem!

I'm not entirely sure about spotify, unless you're just spelling it incorrectly (play.spotifiy.com), but the other two sites require SNI (server name indication), which is not yet functional in the air gap config. Support for that is forthcoming.

Oh, I got Spotify working. Was a network admin that had blocked UDP/443..

So, without SNI support, there is no way to make the sites work using airgap?

There is. I got it working with an iRule patch this morning, but give me a day or two to work out some bugs.

As for tyk.io, SNI is only one of the problems there. That site appears to require ECDHE-ECDSA, and as it happens, ECDSA is the one cipher not currently supported in SSL forward proxy (as of 11.6).

Oh, really? Thats amazing. I was in contact with Support that told me SNI support on Forward Proxy was 2-3 months away, but it would be cool If we could get around it with iRules. :)

Okay, I'm back. 😉

The following iRule mods are for the SSL Intercept iApp. I see that you may be doing something manual, but you may want to try the iApp since it's doing pretty much the same thing and should be able to support your config. So you'll build the iApp and that'll create two iRules - an ingress iRule and an egress iRule.

Here's the modified ingress iRule:

when CLIENT_ACCEPTED {
    HTTP::disable
    SSL::disable clientside
    SSL::disable serverside
    TCP::collect
}
when CLIENT_DATA {  
    binary scan [TCP::payload] c type
    if { ( $type == 23 ) or ( $type == 20 ) } {
        SSL::enable clientside
        SSL::enable serverside
    } elseif { $type == 22 } {
        SSL::enable clientside
        SSL::enable serverside
        HTTP::enable
    } 
    TCP::release    
}
when CLIENTSSL_CLIENTHELLO {
    if { [SSL::extensions exists -type 0] } {
        binary scan [SSL::extensions -type 0] @9a* tls_servername
    }
}
when HTTP_REQUEST {
    if { [info exists tls_servername] } {
        HTTP::header insert X-Proxy-HTTPS "[TCP::local_port]:${tls_servername}"
    } else {
        HTTP::header insert X-Proxy-HTTPS "[TCP::local_port]:0"
    }
    LB::detach
    SSL::disable serverside

     CHANGE THIS TO REFLECT THE REAL INGRESS (PORT 80) POOL NAME
    pool airgap_ingress_pool_80
}

And the modified egress iRule:

when HTTP_REQUEST {
    if { not ( [HTTP::header exists X-Proxy-HTTPS] ) } {
        SSL::disable serverside

         CHAING THIS TO REFLECT THE REAL EGRESS *ANY* POOL NAME
        pool airgap_egress_pool_any
    } else {                   
        if { [lindex [split [HTTP::header X-Proxy-HTTPS] ":"] 1] ne "0" } {
            set servername [lindex [split [HTTP::header X-Proxy-HTTPS] ":"] 1]
        } 
        node [lindex [active_nodes -list airgap_egress_pool_any] 0] [lindex [split [HTTP::header X-Proxy-HTTPS] ":"] 0]
        HTTP::header remove X-Proxy-HTTPS
    }
}
when SERVERSSL_CLIENTHELLO_SEND {   
    if { [info exists servername] } {
        set bin [binary format S1S1S1S1ca* 0 [expr [string length ${servername}] + 5] [expr [string length ${servername}] + 3] 0 [string length ${servername}] ${servername}]   
        SSL::extensions insert $bin
    }   
}

This iRule specifically supports sending SNI across the inspection gap to the egress re-encryption VIP. It'll make it into the iApp soon. As for tyk.io, this site specifically requires ECDHE-ECDSA, which isn't supported in forward proxy SSL until 11.6 HF5 and 12.0. You'll need to upgrade to one of these versions to support these ciphers.