TLS server_name extension based routing without clientssl profile
Problem this snippet solves: Some configuration requires to not decrypt SSL traffic on F5 appliances to select pool based on HTTP Host header.
I found a useful irule and this code keeps the struct...
Updated Jun 06, 2023
Version 2.0Stanislas_Piro2
Cumulonimbus
Joined January 04, 2011
Stanislas_Piro2
Oct 04, 2018Cumulonimbus
If virtual server doesn't have a clientssl profile, assigning an irule with SSL::disable command is not possible.
to allow to use this command only if clientssl profile is assigned, i set a variable with the command and evaluate the command
if { [PROFILE::exists clientssl] } {
We have a clientssl profile attached to this VIP but we need
to find an SNI record in the client handshake. To do so, we'll
disable SSL processing and collect the initial TCP payload.
set ssldisable "SSL::disable"
set sslenable "SSL::enable"
eval $ssldisable
}
[PROFILE::exists clientssl]
is true only if the virtual server have a clientssl profile assigned.