Forum Discussion
Altocumulusvirtual server config
Well, this is up to you.
Per my experience, some customers prefer to offload the SSL decryption task to the F5 unit, so that they don't have to perform additional decriptyon on the backend server farm, saving resources. This is usually also allows more agile administration, because you'll only need to renew the certificates on one appliance (BIG-IP) instead of every server.
Other customers prefer to perform SSL encryption in the backend as well because they prioritize information security across the whole network.You might want to discuss this with your engineering team, and if your servers require the SSL handshake to be performed, you'll need a serverSSL profile.
MVPIf the client requests the URL specifying a destination port, which is :9999 syntax, your network equipment should be configured to accept connections to that port.
You say there's a firewall that performs NAT translation, so I'd guess this is the first access block. Does it translate port from 9999 to 443 as well? (I'm assuming this since you say VS is configured for port 443)
If it doesn't, you need to have a Virtual Server configured with destination port 9999 (again, since this is specified in cliet request) and with tcp, http, and clientSSL/serverSSL profiles.
BIG-IP is a default deny device, so any client request that does not meet this criteria (= there's not a listener configured) will be rejected.
F5 keeps client- and server- connections separate, so if you need to change port before going to the backend server you can do it. Pool configuration should match the port configured in your server farm to listen for this connection / to serve this application.
