Can I set decryption in LTM config on a port other than 443?

Forums Technical Forums
1

hello. My name is Muntae Kim.

Due to the EoTS of the BIG-IP SW used by our client, we are inevitably unable to open the case and would like to ask for your assistance.

Customer information:

- Model name: BIG-IP I7800

- SW information: TMOS 14.1.5

- License: LTM (Forward Proxy) + URL Filtering

- Configuration information: Decryption of 443 traffic outbound from the internal PC to the outside.

Review requirements

- We would like to ask for your help as there is a request for technical review to determine whether decryption is technically possible for Custum Ports (ex. 8443, 7443, etc.) other than the HTTPS (TCP/443) port that the customer is currently decrypting.

- I will attach information about the currently configured Virtual Server and iRules.

We would like to ask for your feedback.

We have attached the iRule used by our customer, so please refer to it for your review.

thank you

<span class="token comment">#________________________________________________________________________________</span>
<span class="token comment">#Virtual Server / 1.1.VS_443_Filter_SRCIP_config.txt</span>
<span class="token comment">#________________________________________________________________________________</span>
ltm virtual <span class="token operator">/</span>Common<span class="token operator">/</span>VS_443_Filter_253.10 <span class="token punctuation">{</span>
    destination <span class="token operator">/</span>Common<span class="token operator">/</span>0.0.0.0:443
    ip<span class="token operator">-</span>protocol tcp
    last<span class="token operator">-</span>modified<span class="token operator">-</span>time 2021<span class="token operator">-</span>03<span class="token operator">-</span>25:19:13:28
    mask any
    pool <span class="token operator">/</span>Common<span class="token operator">/</span>pool<span class="token operator">-</span>fw1
    profiles <span class="token punctuation">{</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>FastL4_Loose <span class="token punctuation">{</span> <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
    rules <span class="token punctuation">{</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>SSL_Filter_Rule
    <span class="token punctuation">}</span>
    <span class="token keyword">source</span> 166.125.253.10<span class="token operator">/</span>32
    translate<span class="token operator">-</span>address disabled
    translate<span class="token operator">-</span>port disabled
    vlans <span class="token punctuation">{</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span><span class="token operator">in</span>
    <span class="token punctuation">}</span>
    vlans<span class="token operator">-</span>enabled
<span class="token punctuation">}</span>
<span class="token comment">#________________________________________________________________________________</span>
<span class="token comment">#Pools</span>
<span class="token comment">#________________________________________________________________________________</span>
ltm pool <span class="token operator">/</span>Common<span class="token operator">/</span>pool<span class="token operator">-</span>fw1 <span class="token punctuation">{</span>
    members <span class="token punctuation">{</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>166.125.0.2:0 <span class="token punctuation">{</span>
            address 166.125.0.2
        <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
<span class="token punctuation">}</span>
<span class="token comment">#________________________________________________________________________________</span>
<span class="token comment">#iRules</span>
<span class="token comment">#________________________________________________________________________________</span>
ltm rule <span class="token operator">/</span>Common<span class="token operator">/</span>SSL_Filter_Rule <span class="token punctuation">{</span>
when CLIENT_ACCEPTED <span class="token punctuation">{</span>
           <span class="token comment"># DEBUG On/Off : 1/0</span>
           <span class="token keyword">set</span> <span class="token variable">DEBUG</span> 0
 
           <span class="token comment"># Check bypass or intercept</span>
           <span class="token comment"># 1. Bypass-DIP for destination IP</span>
           <span class="token comment"># 2. Bypass-SIP for source IP</span>
           <span class="token comment"># 3. Intercept-DIP for destionation IP</span>
           <span class="token comment">#  - trigger TCP::collect to extract SNI</span>
           <span class="token comment"># 4. Intercept-SIP for source IP</span>
           <span class="token comment">#  - trigger TCP::collectto extract SNI</span>
           <span class="token comment"># 5. Bypass-Host for SNI (Only triggered after Intercept-SIP/DIP match)</span>
           <span class="token comment">#   - SNI is matched from Bypass-Host datagroup -> bypass</span>
           <span class="token comment">#   - SNI is matched from Intercept-Host datagroup -> intercetp</span>
           <span class="token comment">#   - Otherwise intercept traffic</span>
 
           <span class="token builtin">if</span> <span class="token punctuation">{</span> $<span class="token variable">DEBUG</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span> log local0. <span class="token string">"[IP::client_addr] -> [IP::local_addr]"</span> <span class="token punctuation">}</span>
           <span class="token builtin">if</span> <span class="token punctuation">{</span> <span class="token punctuation">[</span>class match <span class="token operator">-</span>name <span class="token operator">-</span><span class="token operator">-</span> <span class="token punctuation">[</span>IP::local_addr<span class="token punctuation">]</span> equals Bypass<span class="token operator">-</span>DIP <span class="token punctuation">]</span> <span class="token operator">ne</span> <span class="token string">""</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span>
                     <span class="token builtin">if</span> <span class="token punctuation">{</span> $<span class="token variable">DEBUG</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span> log local0. <span class="token string">"class match result : [class match -name -- [IP::local_addr] equals Bypass-DIP ]"</span> <span class="token punctuation">}</span>
                     <span class="token builtin">if</span> <span class="token punctuation">{</span> $<span class="token variable">DEBUG</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span> log local0. <span class="token string">"Run Destination IP bypass: Destination IP address is registered on bypass list"</span> <span class="token punctuation">}</span>
                     <span class="token comment"># log local0. "run client collect command_1"</span>
                     <span class="token comment">#virtual VS_443_Proxy-1</span>
           <span class="token punctuation">}</span> <span class="token builtin">elseif</span> <span class="token punctuation">{</span> <span class="token punctuation">[</span>class match <span class="token operator">-</span>name <span class="token operator">-</span><span class="token operator">-</span> <span class="token punctuation">[</span>IP::client_addr<span class="token punctuation">]</span> equals Bypass<span class="token operator">-</span>SIP <span class="token punctuation">]</span> <span class="token operator">ne</span> <span class="token string">""</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span>
                     <span class="token builtin">if</span> <span class="token punctuation">{</span> $<span class="token variable">DEBUG</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span> log local0. <span class="token string">"class match result : [class match -name -- [IP::client_addr] equals Bypass-SIP ]"</span> <span class="token punctuation">}</span>
                     <span class="token builtin">if</span> <span class="token punctuation">{</span> $<span class="token variable">DEBUG</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span> log local0. <span class="token string">"Run Source IP bypass: Source IP address is registered on bypass list"</span> <span class="token punctuation">}</span>
           <span class="token punctuation">}</span> <span class="token builtin">elseif</span> <span class="token punctuation">{</span> <span class="token punctuation">[</span>class match <span class="token operator">-</span>name <span class="token operator">-</span><span class="token operator">-</span> <span class="token punctuation">[</span>IP::local_addr<span class="token punctuation">]</span> equals Intercept<span class="token operator">-</span>DIP <span class="token punctuation">]</span> <span class="token operator">ne</span> <span class="token string">""</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span>
                     <span class="token builtin">if</span> <span class="token punctuation">{</span> $<span class="token variable">DEBUG</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span> log local0. <span class="token string">"Destionation IP address is registred on Intercept-DIP list"</span> <span class="token punctuation">}</span>
                     <span class="token builtin">if</span> <span class="token punctuation">{</span> $<span class="token variable">DEBUG</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span> log local0. <span class="token string">"class match result : [class match -name -- [IP::local_addr] equals Intercept-DIP ]"</span> <span class="token punctuation">}</span>
                     <span class="token comment"># log local0. "run client collect command_1"</span>
                     virtual VS_443_Proxy<span class="token operator">-</span>1
           <span class="token punctuation">}</span> <span class="token builtin">elseif</span> <span class="token punctuation">{</span> <span class="token punctuation">[</span>class match <span class="token operator">-</span>name <span class="token operator">-</span><span class="token operator">-</span> <span class="token punctuation">[</span>IP::client_addr<span class="token punctuation">]</span> equals Intercept<span class="token operator">-</span>SIP <span class="token punctuation">]</span> <span class="token operator">ne</span> <span class="token string">""</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span>   
                     <span class="token builtin">if</span> <span class="token punctuation">{</span> $<span class="token variable">DEBUG</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span> log local0. <span class="token string">"Source IP address is registred on Intercept-SIP list"</span> <span class="token punctuation">}</span>
                     <span class="token builtin">if</span> <span class="token punctuation">{</span> $<span class="token variable">DEBUG</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span> log local0. <span class="token string">"class match result : [class match -name -- [IP::client_addr] equals Intercept-SIP ]"</span> <span class="token punctuation">}</span>
                     <span class="token comment"># run TCP collect to check SNI for bypass before intercept SSL traffic</span>
                     <span class="token comment"># log local0. "run client collect command_2"</span>
                     virtual VS_443_Proxy<span class="token operator">-</span>1
           <span class="token punctuation">}</span>
<span class="token punctuation">}</span>
 
<span class="token punctuation">}</span>
<span class="token comment">#________________________________________________________________________________</span>
<span class="token comment">#Profiles</span>
<span class="token comment">#________________________________________________________________________________</span>
ltm profile fastl4 <span class="token operator">/</span>Common<span class="token operator">/</span>FastL4_Loose <span class="token punctuation">{</span>
    app<span class="token operator">-</span>service none
    defaults<span class="token operator">-</span>from <span class="token operator">/</span>Common<span class="token operator">/</span>fastL4
    hardware<span class="token operator">-</span>syn<span class="token operator">-</span>cookie disabled
    loose<span class="token operator">-</span>close enabled
    loose<span class="token operator">-</span>initialization enabled
    reset<span class="token operator">-</span>on<span class="token operator">-</span>timeout disabled
    syn<span class="token operator">-</span>cookie<span class="token operator">-</span>enable disabled
<span class="token punctuation">}</span>
 <span class="token comment">#________________________________________________________________________________</span>
<span class="token comment">#Virtual Server / 1.2.VS_443_Proxy-1_config.txt</span>
<span class="token comment">#________________________________________________________________________________</span>
ltm virtual <span class="token operator">/</span>Common<span class="token operator">/</span>VS_443_Proxy<span class="token operator">-</span>1 <span class="token punctuation">{</span>
    destination <span class="token operator">/</span>Common<span class="token operator">/</span>0.0.0.0:443
    ip<span class="token operator">-</span>protocol tcp
    mask any
    pool <span class="token operator">/</span>Common<span class="token operator">/</span>pool<span class="token operator">-</span>fw1
    profiles <span class="token punctuation">{</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>ClientSSL_Profiles <span class="token punctuation">{</span>
            context clientside
        <span class="token punctuation">}</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>ServerSSL_Profiles <span class="token punctuation">{</span>
            context serverside
        <span class="token punctuation">}</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>http <span class="token punctuation">{</span> <span class="token punctuation">}</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>tcp<span class="token operator">-</span>lan<span class="token operator">-</span>optimized <span class="token punctuation">{</span> <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
    rules <span class="token punctuation">{</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>SSL_Forward_Bypass_Rule_Debug_Complete_v2_Complete
    <span class="token punctuation">}</span>
    <span class="token keyword">source</span> 0.0.0.0<span class="token operator">/</span>0
    translate<span class="token operator">-</span>address disabled
    translate<span class="token operator">-</span>port disabled
    vlans<span class="token operator">-</span>enabled
<span class="token punctuation">}</span>
<span class="token comment">#________________________________________________________________________________</span>
<span class="token comment">#Pools</span>
<span class="token comment">#________________________________________________________________________________</span>
ltm pool <span class="token operator">/</span>Common<span class="token operator">/</span>pool<span class="token operator">-</span>fw1 <span class="token punctuation">{</span>
    members <span class="token punctuation">{</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>166.125.0.2:0 <span class="token punctuation">{</span>
            address 166.125.0.2
        <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
<span class="token punctuation">}</span>
<span class="token comment">#________________________________________________________________________________</span>
<span class="token comment">#iRules</span>
<span class="token comment">#________________________________________________________________________________</span>
ltm rule <span class="token operator">/</span>Common<span class="token operator">/</span>SSL_Forward_Bypass_Rule_Debug_Complete_v2_Complete <span class="token punctuation">{</span>
when RULE_INIT <span class="token punctuation">{</span>
                       <span class="token comment"># you can add or remove Categories. See Access Policy - Secure Web Gateway - URL Categories for a list of options</span>
           <span class="token keyword">set</span> <span class="token variable">static::airgap_ssl_bypass_categories</span> <span class="token punctuation">{</span>
                      <span class="token operator">/</span>Common<span class="token operator">/</span>Financial_Data_and_Services
           <span class="token punctuation">}</span>
<span class="token punctuation">}</span>
 
when CLIENT_ACCEPTED <span class="token punctuation">{</span>
           <span class="token comment">###set hsl [HSL::open -proto UDP -pool syslog_server_pool]</span>
           <span class="token comment"># DEBUG On/Off : 1/0</span>
           <span class="token keyword">set</span> <span class="token variable">DEBUG</span> 0
           <span class="token comment"># disable client/serverside ssl profile by default</span>
           HTTP::disable
           SSL::disable clientside
           SSL::disable serverside
 
           <span class="token comment"># Check bypass or intercept</span>
           <span class="token comment"># 1. Bypass-DIP for destination IP</span>
           <span class="token comment"># 2. Bypass-SIP for source IP</span>
           <span class="token comment"># 3. Intercept-DIP for destionation IP</span>
           <span class="token comment">#  - trigger TCP::collect to extract SNI</span>
           <span class="token comment"># 4. Intercept-SIP for source IP</span>
           <span class="token comment">#  - trigger TCP::collectto extract SNI</span>
           <span class="token comment"># 5. Bypass-Host for SNI (Only triggered after Intercept-SIP/DIP match)</span>
           <span class="token comment">#   - SNI is matched from Bypass-Host datagroup -> bypass</span>
           <span class="token comment">#   - SNI is matched from Intercept-Host datagroup -> intercetp</span>
           <span class="token comment">#   - Otherwise intercept traffic</span>
 
           <span class="token comment">#if { $DEBUG } { log local0. "[IP::client_addr] -> [IP::local_addr]" }</span>
           <span class="token comment">#if { [class match -name -- [IP::local_addr] equals Bypass-DIP ] ne "" } {</span>
           <span class="token comment">#          if { $DEBUG } { HSL::send $hsl "class match result : [class match -name -- [IP::local_addr] equals Bypass-DIP ] --Bypass-DIP" }</span>
           <span class="token comment">#          if { $DEBUG } { log local0. "Run Destination IP bypass: Destination IP address is registered on bypass list: [IP::local_addr]" }</span>
           <span class="token comment">#} elseif { [class match -name -- [IP::client_addr] equals Bypass-SIP ] ne "" } {</span>
           <span class="token comment">#           if { $DEBUG } { log local0. "class match result : [class match -name -- [IP::client_addr] equals Bypass-SIP ]" }</span>
           <span class="token comment">#           if { $DEBUG } { log local0. "Run Source IP bypass: Source IP address is registered on bypass list: [IP::client_addr]" }</span>
           <span class="token comment">#}</span>
                        <span class="token builtin">if</span> <span class="token punctuation">{</span> <span class="token punctuation">[</span>class match <span class="token operator">-</span>name <span class="token operator">-</span><span class="token operator">-</span> <span class="token punctuation">[</span>IP::local_addr<span class="token punctuation">]</span> equals Intercept<span class="token operator">-</span>DIP <span class="token punctuation">]</span> <span class="token operator">ne</span> <span class="token string">""</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span>
                      <span class="token comment">#if { $DEBUG } { log local0. "Destionation IP address is registred on Intercept-DIP list" }</span>
                      <span class="token comment">#if { $DEBUG } { log local0. "class match result : [class match -name -- [IP::local_addr] equals Intercept-DIP ]" }</span>
                      <span class="token comment"># run TCP collect to check SNI for bypass before Intercept-DIP SSL traffic</span>
                      <span class="token comment"># log local0. "run client collect command"</span>
                      TCP::collect
                      <span class="token keyword">set</span> <span class="token variable">monitor_id</span> <span class="token punctuation">[</span>\
                      <span class="token keyword">after</span> 500 <span class="token punctuation">{</span>
                                 TCP::release
                                 <span class="token comment">#if { $DEBUG } { log local0. "[IP::client_addr]:[TCP::client_port]-[IP::local_addr]:[TCP::local_port] -No Delayed Binding"}</span>
                      <span class="token punctuation">}</span>\
                      <span class="token punctuation">]</span>
 
           <span class="token punctuation">}</span> <span class="token builtin">elseif</span> <span class="token punctuation">{</span> <span class="token punctuation">[</span>class match <span class="token operator">-</span>name <span class="token operator">-</span><span class="token operator">-</span> <span class="token punctuation">[</span>IP::client_addr<span class="token punctuation">]</span> equals Intercept<span class="token operator">-</span>SIP <span class="token punctuation">]</span> <span class="token operator">ne</span> <span class="token string">""</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span> 
                      <span class="token comment">#if { $DEBUG } { log local0. "Source IP address is registred on Intercept-SIP list" }</span>
                      <span class="token comment">#if { $DEBUG } { log local0. "class match result : [class match -name -- [IP::client_addr] equals Intercept-SIP ]" }</span>
                      <span class="token comment"># run TCP collect to check SNI for bypass before intercept SSL traffic</span>
                      <span class="token comment"># log local0. "run client collect command"</span>
 
                      TCP::collect
                      <span class="token keyword">set</span> <span class="token variable">monitor_id</span> <span class="token punctuation">[</span>\
                      <span class="token keyword">after</span> 500 <span class="token punctuation">{</span>
                                 TCP::release
                                 <span class="token comment">#if { $DEBUG } { log local0. "[IP::client_addr]:[TCP::client_port]-[IP::local_addr]:[TCP::local_port] -No Delayed Binding"}</span>
                      <span class="token punctuation">}</span>\
                      <span class="token punctuation">]</span>
           <span class="token punctuation">}</span>
<span class="token punctuation">}</span>
 
when CLIENT_DATA <span class="token punctuation">{</span>
           <span class="token keyword">after</span> cancel $<span class="token variable">monitor_id</span>
           <span class="token keyword">binary</span> <span class="token keyword">scan</span> <span class="token punctuation">[</span>TCP::payload<span class="token punctuation">]</span> cSS tls_xacttype tls_version tls_recordlen
 
           <span class="token builtin">if</span> <span class="token punctuation">{</span> <span class="token punctuation">(</span> $<span class="token variable">tls_xacttype</span> <span class="token operator">==</span> 23 <span class="token punctuation">)</span> or <span class="token punctuation">(</span> $<span class="token variable">tls_xacttype</span> <span class="token operator">==</span> 20 <span class="token punctuation">)</span> or <span class="token punctuation">(</span>$<span class="token variable">tls_xacttype</span> <span class="token operator">==</span> 22<span class="token punctuation">)</span><span class="token punctuation">}</span> <span class="token punctuation">{</span>
                      <span class="token keyword">set</span> <span class="token variable">record_offset</span> 43
                      <span class="token keyword">binary</span> <span class="token keyword">scan</span> <span class="token punctuation">[</span>TCP::payload<span class="token punctuation">]</span> @$<span class="token variable">{record_offset}</span>c tls_sessidlen
                      <span class="token keyword">set</span> <span class="token variable">record_offset</span> <span class="token punctuation">[</span><span class="token keyword">expr</span> <span class="token punctuation">{</span>$<span class="token variable">record_offset</span> <span class="token operator">+</span> 1 <span class="token operator">+</span> $<span class="token variable">tls_sessidlen</span><span class="token punctuation">}</span><span class="token punctuation">]</span>
                      <span class="token keyword">binary</span> <span class="token keyword">scan</span> <span class="token punctuation">[</span>TCP::payload<span class="token punctuation">]</span> @$<span class="token variable">{record_offset}</span>S tls_ciphlen
                      <span class="token keyword">set</span> <span class="token variable">record_offset</span> <span class="token punctuation">[</span><span class="token keyword">expr</span> <span class="token punctuation">{</span>$<span class="token variable">record_offset</span> <span class="token operator">+</span> 2 <span class="token operator">+</span> $<span class="token variable">tls_ciphlen</span><span class="token punctuation">}</span><span class="token punctuation">]</span>
                      <span class="token keyword">binary</span> <span class="token keyword">scan</span> <span class="token punctuation">[</span>TCP::payload<span class="token punctuation">]</span> @$<span class="token variable">{record_offset}</span>c tls_complen
                      <span class="token keyword">set</span> <span class="token variable">record_offset</span> <span class="token punctuation">[</span><span class="token keyword">expr</span> <span class="token punctuation">{</span>$<span class="token variable">record_offset</span> <span class="token operator">+</span> 1 <span class="token operator">+</span> $<span class="token variable">tls_complen</span><span class="token punctuation">}</span><span class="token punctuation">]</span>
 
                      <span class="token builtin">if</span> <span class="token punctuation">{</span> <span class="token punctuation">(</span><span class="token punctuation">[</span>TCP::payload length<span class="token punctuation">]</span> <span class="token operator">></span> $<span class="token variable">record_offset</span><span class="token punctuation">)</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span>
                                 <span class="token keyword">binary</span> <span class="token keyword">scan</span> <span class="token punctuation">[</span>TCP::payload<span class="token punctuation">]</span> @$<span class="token variable">{record_offset}</span>S tls_extenlen
                                 <span class="token keyword">set</span> <span class="token variable">record_offset</span> <span class="token punctuation">[</span><span class="token keyword">expr</span> <span class="token punctuation">{</span>$<span class="token variable">record_offset</span> <span class="token operator">+</span> 2<span class="token punctuation">}</span><span class="token punctuation">]</span>
                                 <span class="token keyword">binary</span> <span class="token keyword">scan</span> <span class="token punctuation">[</span>TCP::payload<span class="token punctuation">]</span> @$<span class="token variable">{record_offset}</span>a<span class="token operator">*</span> tls_extensions
                                 <span class="token builtin">for</span> <span class="token punctuation">{</span> set x 0 <span class="token punctuation">}</span> <span class="token punctuation">{</span> $<span class="token variable">x</span> <span class="token operator"><</span> $<span class="token variable">tls_extenlen</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span> incr x 4 <span class="token punctuation">}</span> <span class="token punctuation">{</span>
                                             <span class="token keyword">set</span> <span class="token variable">start</span> <span class="token punctuation">[</span><span class="token keyword">expr</span> <span class="token punctuation">{</span>$<span class="token variable">x</span><span class="token punctuation">}</span><span class="token punctuation">]</span>
                                             <span class="token keyword">binary</span> <span class="token keyword">scan</span> $<span class="token variable">tls_extensions</span> @$<span class="token variable">{start}</span>SS etype elen
                                             <span class="token builtin">if</span> <span class="token punctuation">{</span> <span class="token punctuation">(</span>$<span class="token variable">etype</span> <span class="token operator">==</span> <span class="token string">"00"</span><span class="token punctuation">)</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span>
                                                        <span class="token keyword">set</span> <span class="token variable">grabstart</span> <span class="token punctuation">[</span><span class="token keyword">expr</span> <span class="token punctuation">{</span>$<span class="token variable">start</span> <span class="token operator">+</span> 9<span class="token punctuation">}</span><span class="token punctuation">]</span>
                                                        <span class="token keyword">set</span> <span class="token variable">grabend</span> <span class="token punctuation">[</span><span class="token keyword">expr</span> <span class="token punctuation">{</span>$<span class="token variable">elen</span> <span class="token operator">-</span> 5<span class="token punctuation">}</span><span class="token punctuation">]</span>
                                                        <span class="token keyword">binary</span> <span class="token keyword">scan</span> $<span class="token variable">tls_extensions</span> @$<span class="token variable">{grabstart}</span>A$<span class="token variable">{grabend}</span> tls_servername
                                                        <span class="token keyword">set</span> <span class="token variable">start</span> <span class="token punctuation">[</span><span class="token keyword">expr</span> <span class="token punctuation">{</span>$<span class="token variable">start</span> <span class="token operator">+</span> $<span class="token variable">elen</span><span class="token punctuation">}</span><span class="token punctuation">]</span>
                                             <span class="token punctuation">}</span> <span class="token builtin">else</span> <span class="token punctuation">{</span>
 
                                                        <span class="token comment"># Bypass all other TLS extensions.</span>
                                                        <span class="token keyword">set</span> <span class="token variable">start</span> <span class="token punctuation">[</span><span class="token keyword">expr</span> <span class="token punctuation">{</span>$<span class="token variable">start</span> <span class="token operator">+</span> $<span class="token variable">elen</span><span class="token punctuation">}</span><span class="token punctuation">]</span>
                                             <span class="token punctuation">}</span>
                                             <span class="token keyword">set</span> <span class="token variable">x</span> $<span class="token variable">start</span>
                                 <span class="token punctuation">}</span>
                      <span class="token punctuation">}</span>
 
                      <span class="token builtin">if</span> <span class="token punctuation">{</span> <span class="token punctuation">(</span><span class="token punctuation">[</span><span class="token keyword">info</span> exists tls_servername<span class="token punctuation">]</span><span class="token punctuation">)</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span>
                                             <span class="token comment">#if { $DEBUG } { log local0. "[IP::client_addr]:[TCP::client_port] - [IP::local_addr]:[TCP::local_port] $tls_servername"}</span>
                                 <span class="token builtin">if</span> <span class="token punctuation">{</span> <span class="token punctuation">[</span>class match $<span class="token variable">tls_servername</span> contains Intercept<span class="token operator">-</span>Host<span class="token punctuation">]</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span>
                                             <span class="token builtin">if</span> <span class="token punctuation">{</span> $<span class="token variable">DEBUG</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span> log local0. <span class="token string">"[IP::client_addr]:[TCP::client_port] -> [IP::local_addr] $tls_servername --Intercept-Host"</span><span class="token punctuation">}</span>
                                                                                                                     <span class="token comment">##1##if { $DEBUG } { HSL::send $hsl "[IP::client_addr]:[TCP::client_port] -> [IP::local_addr] $tls_servername --Intercept-Host"}</span>
                                             <span class="token comment">#if { $DEBUG } { log local0. "class match result : [class match -name -- $tls_servername equals Intercept-Host ]" }</span>
                                             <span class="token comment">#if { $DEBUG } { log local0. "RUN Intercept-Host: SNI is matched with Intercept-Host: $tls_servername" }</span>
                                             virtual VS_443_Proxy<span class="token operator">-</span>3
                                             <span class="token comment">####SSL::enable clientside</span>
                                             <span class="token comment">####SSL::enable serverside</span>
                                             <span class="token comment">####HTTP::enable</span>
                                 <span class="token punctuation">}</span>
                                 <span class="token builtin">elseif</span> <span class="token punctuation">{</span> <span class="token punctuation">[</span>class match $<span class="token variable">tls_servername</span> contains Bypass<span class="token operator">-</span>Host<span class="token punctuation">]</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span>
                                             <span class="token builtin">if</span> <span class="token punctuation">{</span> $<span class="token variable">DEBUG</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span> log local0. <span class="token string">"[IP::client_addr]:[TCP::client_port] -> [IP::local_addr] $tls_servername --Bypass-Host"</span><span class="token punctuation">}</span>
                                                                                                                     <span class="token comment">##2##if { $DEBUG } { HSL::send $hsl "[IP::client_addr]:[TCP::client_port] -> [IP::local_addr] $tls_servername --Bypass-Host"}</span>
                                             <span class="token comment">#if { $DEBUG } { log local0. "[IP::client_addr]:[TCP::client_port] -> [IP::local_addr] $tls_servername --Bypass-Host"}</span>
                                             <span class="token comment">#if { $DEBUG } { log local0. "Run Bypass-Host: SNI is matched with Bypass-Host" }</span>
                                 <span class="token punctuation">}</span>
                                 <span class="token builtin">else</span> <span class="token punctuation">{</span>
                                             <span class="token keyword">set</span> <span class="token variable">this_uri</span> <span class="token keyword">http</span>:<span class="token operator">/</span><span class="token operator">/</span>$<span class="token variable">tls_servername</span><span class="token operator">/</span>
                                             <span class="token keyword">set</span> <span class="token variable">reply</span> <span class="token punctuation">[</span>getfield <span class="token punctuation">[</span>CATEGORY::lookup $<span class="token variable">this_uri</span><span class="token punctuation">]</span> <span class="token string">" "</span> 1<span class="token punctuation">]</span>
                                             <span class="token keyword">set</span> <span class="token variable">decision</span> <span class="token punctuation">[</span><span class="token keyword">lsearch</span> <span class="token operator">-</span>exact $<span class="token variable">static::airgap_ssl_bypass_categories</span> $<span class="token variable">reply</span><span class="token punctuation">]</span>
                                             <span class="token builtin">if</span> <span class="token punctuation">{</span><span class="token punctuation">[</span><span class="token keyword">lsearch</span> <span class="token operator">-</span>exact $<span class="token variable">static::airgap_ssl_bypass_categories</span> $<span class="token variable">reply</span><span class="token punctuation">]</span> <span class="token operator">>=</span> 0<span class="token punctuation">}</span><span class="token punctuation">{</span>
                                                        <span class="token keyword">set</span> <span class="token variable">ssl_bypass_mitm</span> 1
                                                        <span class="token builtin">if</span> <span class="token punctuation">{</span> $<span class="token variable">DEBUG</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span> log local0. <span class="token string">"[IP::client_addr]:[TCP::client_port] -> [IP::local_addr] $tls_servername --Bypass-Category"</span><span class="token punctuation">}</span>
                                                                                                                                                      <span class="token comment">##3##if { $DEBUG } { HSL::send $hsl "[IP::client_addr]:[TCP::client_port] -> [IP::local_addr] $tls_servername --Bypass-Category"}</span>
                                             <span class="token punctuation">}</span> <span class="token builtin">else</span> <span class="token punctuation">{</span>
                                                        <span class="token keyword">set</span> <span class="token variable">ssl_bypass_mitm</span> 0
                                             <span class="token punctuation">}</span>
                                             <span class="token builtin">if</span> <span class="token punctuation">{</span> <span class="token punctuation">[</span><span class="token keyword">info</span> exists ssl_bypass_mitm<span class="token punctuation">]</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span>
                                                        <span class="token builtin">if</span> <span class="token punctuation">{</span> $<span class="token variable">ssl_bypass_mitm</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span>
                                                                      <span class="token comment">#log local0. "$static::airgap_ssl_bypass_categories $reply"</span>
                                                                      <span class="token comment">#log local0. "$reply"</span>
                                                        <span class="token punctuation">}</span> <span class="token builtin">else</span> <span class="token punctuation">{</span>
                                                                   SSL::enable clientside
                                                                   SSL::enable serverside
                                                                   HTTP::enable
                                                        <span class="token punctuation">}</span>
                                             <span class="token punctuation">}</span>
                                 <span class="token punctuation">}</span>
                      <span class="token punctuation">}</span> <span class="token builtin">else</span> <span class="token punctuation">{</span>
                                 <span class="token comment">#if { $DEBUG } { log local0. "No SNI exist -> Run Intercept by Intercept-SIP or Intercpet-DIP" }</span>
                                 SSL::enable clientside
                                 SSL::enable serverside
                                 HTTP::enable
                      <span class="token punctuation">}</span>
           <span class="token punctuation">}</span>
           TCP::release
<span class="token punctuation">}</span>
 
when CLIENTSSL_HANDSHAKE <span class="token punctuation">{</span>
    <span class="token builtin">if</span> <span class="token punctuation">{</span> $<span class="token variable">DEBUG</span> <span class="token punctuation">}</span> <span class="token punctuation">{</span> log local0. <span class="token string">"[IP::client_addr]:[TCP::client_port] -> [IP::local_addr] $tls_servername --Decryption"</span><span class="token punctuation">}</span>
           <span class="token comment">##4##if { $DEBUG } { HSL::send $hsl "[IP::client_addr]:[TCP::client_port] -> [IP::local_addr] $tls_servername --Decryption"}</span>
           LB::detach
           SSL::disable serverside
           virtual VS_443_Proxy<span class="token operator">-</span>2
<span class="token punctuation">}</span>
<span class="token punctuation">}</span>
<span class="token comment">#________________________________________________________________________________</span>
<span class="token comment">#Profiles</span>
<span class="token comment">#________________________________________________________________________________</span>
ltm profile client<span class="token operator">-</span>ssl <span class="token operator">/</span>Common<span class="token operator">/</span>ClientSSL_Profiles <span class="token punctuation">{</span>
    app<span class="token operator">-</span>service none
    cert <span class="token operator">/</span>Common<span class="token operator">/</span>default.crt
    cert<span class="token operator">-</span>key<span class="token operator">-</span>chain <span class="token punctuation">{</span>
        CA_ <span class="token punctuation">{</span>
            cert <span class="token operator">/</span>Common<span class="token operator">/</span>_.crt
            key <span class="token operator">/</span>Common<span class="token operator">/</span>_.key
            usage CA
        <span class="token punctuation">}</span>
        default <span class="token punctuation">{</span>
            cert <span class="token operator">/</span>Common<span class="token operator">/</span>default.crt
            key <span class="token operator">/</span>Common<span class="token operator">/</span>default.key
        <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
    cert<span class="token operator">-</span>lifespan 365
    chain none
    defaults<span class="token operator">-</span>from <span class="token operator">/</span>Common<span class="token operator">/</span>clientssl
    hostname<span class="token operator">-</span>blacklist <span class="token operator">/</span>Common<span class="token operator">/</span>Intercept<span class="token operator">-</span>Host
    hostname<span class="token operator">-</span>whitelist <span class="token operator">/</span>Common<span class="token operator">/</span>Bypass<span class="token operator">-</span>Host
    inherit<span class="token operator">-</span>ca<span class="token operator">-</span>certkeychain false
    inherit<span class="token operator">-</span>certkeychain true
    key <span class="token operator">/</span>Common<span class="token operator">/</span>default.key
    passphrase none
    proxy<span class="token operator">-</span>ca<span class="token operator">-</span>cert <span class="token operator">/</span>Common<span class="token operator">/</span>_.crt
    proxy<span class="token operator">-</span>ca<span class="token operator">-</span>key <span class="token operator">/</span>Common<span class="token operator">/</span>_.key
    retain<span class="token operator">-</span>certificate false
    ssl<span class="token operator">-</span>forward<span class="token operator">-</span>proxy enabled
    ssl<span class="token operator">-</span>forward<span class="token operator">-</span>proxy<span class="token operator">-</span>bypass enabled
<span class="token punctuation">}</span>
ltm profile server<span class="token operator">-</span>ssl <span class="token operator">/</span>Common<span class="token operator">/</span>ServerSSL_Profiles <span class="token punctuation">{</span>
    app<span class="token operator">-</span>service none
    ca<span class="token operator">-</span>file <span class="token operator">/</span>Common<span class="token operator">/</span>ca<span class="token operator">-</span>bundle.crt
    cipher<span class="token operator">-</span>group none
    ciphers ALL
    defaults<span class="token operator">-</span>from <span class="token operator">/</span>Common<span class="token operator">/</span>serverssl
    secure<span class="token operator">-</span>renegotiation request
    ssl<span class="token operator">-</span>forward<span class="token operator">-</span>proxy enabled
    ssl<span class="token operator">-</span>forward<span class="token operator">-</span>proxy<span class="token operator">-</span>bypass enabled
<span class="token punctuation">}</span>
<span class="token comment"># -Default Profile-</span>
ltm profile http http <span class="token punctuation">{</span>
    basic<span class="token operator">-</span>auth<span class="token operator">-</span>realm none
    lws<span class="token operator">-</span>width 80
    oneconnect<span class="token operator">-</span>transformations enabled
    oneconnect<span class="token operator">-</span>status<span class="token operator">-</span>reuse <span class="token string">"200 206"</span>
    proxy<span class="token operator">-</span>type reverse
    enforcement <span class="token punctuation">{</span>
        max<span class="token operator">-</span>header<span class="token operator">-</span>count 64
        max<span class="token operator">-</span>header<span class="token operator">-</span>size 32768
        pipeline allow
        <span class="token keyword">unknown</span><span class="token operator">-</span>method allow
    <span class="token punctuation">}</span>
    request<span class="token operator">-</span>chunking preserve
    response<span class="token operator">-</span>chunking selective
<span class="token punctuation">}</span>
<span class="token comment"># -Default Profile-</span>
ltm profile tcp tcp<span class="token operator">-</span>lan<span class="token operator">-</span>optimized <span class="token punctuation">{</span>
    ack<span class="token operator">-</span>on<span class="token operator">-</span>push enabled
    defaults<span class="token operator">-</span>from <span class="token operator">/</span>Common<span class="token operator">/</span>tcp<span class="token operator">-</span>legacy
    nagle disabled
    proxy<span class="token operator">-</span>buffer<span class="token operator">-</span>high 131072
    proxy<span class="token operator">-</span>buffer<span class="token operator">-</span>low 98304
    receive<span class="token operator">-</span>window<span class="token operator">-</span>size 65535
    send<span class="token operator">-</span>buffer<span class="token operator">-</span>size 65535
    slow<span class="token operator">-</span>start disabled
<span class="token punctuation">}</span>
 
<span class="token comment">#________________________________________________________________________________</span>
<span class="token comment">#Virtual Server / 1.3.VS_443_Proxy-2_config.txt</span>
<span class="token comment">#________________________________________________________________________________</span>
ltm virtual <span class="token operator">/</span>Common<span class="token operator">/</span>VS_443_Proxy<span class="token operator">-</span>2 <span class="token punctuation">{</span>
    clone<span class="token operator">-</span>pools <span class="token punctuation">{</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>pool<span class="token operator">-</span>mirroring <span class="token punctuation">{</span>
            context clientside
        <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
    destination <span class="token operator">/</span>Common<span class="token operator">/</span>0.0.0.0:443
    ip<span class="token operator">-</span>protocol tcp
    mask any
    pool <span class="token operator">/</span>Common<span class="token operator">/</span>pool<span class="token operator">-</span>fw1
    profiles <span class="token punctuation">{</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>ServerSSL_Insecure_Profiles <span class="token punctuation">{</span>
            context serverside
        <span class="token punctuation">}</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>http <span class="token punctuation">{</span> <span class="token punctuation">}</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>tcp<span class="token operator">-</span>lan<span class="token operator">-</span>optimized <span class="token punctuation">{</span> <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
    rules <span class="token punctuation">{</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>SSL_Forward_Proxy<span class="token operator">-</span>2_Rule
    <span class="token punctuation">}</span>
    <span class="token keyword">source</span> 0.0.0.0<span class="token operator">/</span>0
    translate<span class="token operator">-</span>address disabled
    translate<span class="token operator">-</span>port disabled
    vlans<span class="token operator">-</span>enabled
<span class="token punctuation">}</span>
<span class="token comment">#________________________________________________________________________________</span>
<span class="token comment">#Pools</span>
<span class="token comment">#________________________________________________________________________________</span>
ltm pool <span class="token operator">/</span>Common<span class="token operator">/</span>pool<span class="token operator">-</span>fw1 <span class="token punctuation">{</span>
    members <span class="token punctuation">{</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>166.125.0.2:0 <span class="token punctuation">{</span>
            address 166.125.0.2
        <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
<span class="token punctuation">}</span>
ltm pool <span class="token operator">/</span>Common<span class="token operator">/</span>pool<span class="token operator">-</span>mirroring <span class="token punctuation">{</span>
    members <span class="token punctuation">{</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>10.10.10.21:0 <span class="token punctuation">{</span>
            address 10.10.10.21
        <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
<span class="token punctuation">}</span>
<span class="token comment">#________________________________________________________________________________</span>
<span class="token comment">#iRules</span>
<span class="token comment">#________________________________________________________________________________</span>
ltm rule <span class="token operator">/</span>Common<span class="token operator">/</span>SSL_Forward_Proxy<span class="token operator">-</span>2_Rule <span class="token punctuation">{</span>
<span class="token comment">#</span>
<span class="token comment"># Add server_name extension in server-side's Client Hello using client-side's HTTP host header</span>
<span class="token comment">#</span>
when HTTP_REQUEST <span class="token punctuation">{</span>
  <span class="token keyword">set</span> <span class="token variable">name</span> <span class="token punctuation">[</span>HTTP::host<span class="token punctuation">]</span>
<span class="token punctuation">}</span>
when SERVERSSL_CLIENTHELLO_SEND <span class="token punctuation">{</span>
  <span class="token keyword">set</span> <span class="token variable">name_len</span> <span class="token punctuation">[</span><span class="token keyword">string</span> length $<span class="token variable">name</span><span class="token punctuation">]</span>
  <span class="token keyword">set</span> <span class="token variable">name_list_len</span> <span class="token punctuation">[</span><span class="token keyword">expr</span> <span class="token punctuation">{</span>$<span class="token variable">name_len</span> <span class="token operator">+</span> 3<span class="token punctuation">}</span><span class="token punctuation">]</span>
  <span class="token keyword">set</span> <span class="token variable">name_type</span> 0
  <span class="token keyword">set</span> <span class="token variable">ext_type</span> 0
  <span class="token keyword">set</span> <span class="token variable">ext_len</span> <span class="token punctuation">[</span><span class="token keyword">expr</span> <span class="token punctuation">{</span>$<span class="token variable">name_len</span> <span class="token operator">+</span> 5<span class="token punctuation">}</span><span class="token punctuation">]</span>
 
  SSL::extensions insert <span class="token punctuation">[</span><span class="token keyword">binary</span> format S1S1S1cS1a<span class="token operator">*</span> $<span class="token variable">ext_type</span> $<span class="token variable">ext_len</span> $<span class="token variable">name_list_len</span> $<span class="token variable">name_type</span> $<span class="token variable">name_len</span> $<span class="token variable">name</span><span class="token punctuation">]</span>
 
<span class="token punctuation">}</span>
 
<span class="token punctuation">}</span>
<span class="token comment">#________________________________________________________________________________</span>
<span class="token comment">#Profiles</span>
<span class="token comment">#________________________________________________________________________________</span>
ltm profile server<span class="token operator">-</span>ssl <span class="token operator">/</span>Common<span class="token operator">/</span>ServerSSL_Insecure_Profiles <span class="token punctuation">{</span>
    app<span class="token operator">-</span>service none
    cipher<span class="token operator">-</span>group none
    ciphers ALL
    defaults<span class="token operator">-</span>from <span class="token operator">/</span>Common<span class="token operator">/</span>serverssl<span class="token operator">-</span>insecure<span class="token operator">-</span>compatible
    retain<span class="token operator">-</span>certificate false
<span class="token punctuation">}</span>
<span class="token comment"># -Default Profile-</span>
ltm profile http http <span class="token punctuation">{</span>
    basic<span class="token operator">-</span>auth<span class="token operator">-</span>realm none
    lws<span class="token operator">-</span>width 80
    oneconnect<span class="token operator">-</span>transformations enabled
    oneconnect<span class="token operator">-</span>status<span class="token operator">-</span>reuse <span class="token string">"200 206"</span>
    proxy<span class="token operator">-</span>type reverse
    enforcement <span class="token punctuation">{</span>
        max<span class="token operator">-</span>header<span class="token operator">-</span>count 64
        max<span class="token operator">-</span>header<span class="token operator">-</span>size 32768
        pipeline allow
        <span class="token keyword">unknown</span><span class="token operator">-</span>method allow
    <span class="token punctuation">}</span>
    request<span class="token operator">-</span>chunking preserve
    response<span class="token operator">-</span>chunking selective
<span class="token punctuation">}</span>
<span class="token comment"># -Default Profile-</span>
ltm profile tcp tcp<span class="token operator">-</span>lan<span class="token operator">-</span>optimized <span class="token punctuation">{</span>
    ack<span class="token operator">-</span>on<span class="token operator">-</span>push enabled
    defaults<span class="token operator">-</span>from <span class="token operator">/</span>Common<span class="token operator">/</span>tcp<span class="token operator">-</span>legacy
    nagle disabled
    proxy<span class="token operator">-</span>buffer<span class="token operator">-</span>high 131072
    proxy<span class="token operator">-</span>buffer<span class="token operator">-</span>low 98304
    receive<span class="token operator">-</span>window<span class="token operator">-</span>size 65535
    send<span class="token operator">-</span>buffer<span class="token operator">-</span>size 65535
    slow<span class="token operator">-</span>start disabled
<span class="token punctuation">}</span>
<span class="token comment">#________________________________________________________________________________</span>
<span class="token comment">#Virtual Server / 1.4.VS_443_Proxy-3_config.txt</span>
<span class="token comment">#________________________________________________________________________________</span>
ltm virtual <span class="token operator">/</span>Common<span class="token operator">/</span>VS_443_Proxy<span class="token operator">-</span>3 <span class="token punctuation">{</span>
    creation<span class="token operator">-</span>time 2022<span class="token operator">-</span>09<span class="token operator">-</span>28:15:50:34
    destination <span class="token operator">/</span>Common<span class="token operator">/</span>0.0.0.0:443
    ip<span class="token operator">-</span>protocol tcp
    last<span class="token operator">-</span>modified<span class="token operator">-</span>time 2022<span class="token operator">-</span>09<span class="token operator">-</span>28:15:53:45
    mask any
    pool <span class="token operator">/</span>Common<span class="token operator">/</span>pool<span class="token operator">-</span>fw1
    profiles <span class="token punctuation">{</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>ClientSSL_Profiles_nobypass <span class="token punctuation">{</span>
            context clientside
        <span class="token punctuation">}</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>ServerSSL_Profiles <span class="token punctuation">{</span>
            context serverside
        <span class="token punctuation">}</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>http <span class="token punctuation">{</span> <span class="token punctuation">}</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>tcp<span class="token operator">-</span>lan<span class="token operator">-</span>optimized <span class="token punctuation">{</span> <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
    rules <span class="token punctuation">{</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>SSL_Forward_Proxy<span class="token operator">-</span>3_Rule
    <span class="token punctuation">}</span>
    <span class="token keyword">source</span> 0.0.0.0<span class="token operator">/</span>0
    translate<span class="token operator">-</span>address disabled
    translate<span class="token operator">-</span>port disabled
    vlans<span class="token operator">-</span>enabled
<span class="token punctuation">}</span>
<span class="token comment">#________________________________________________________________________________</span>
<span class="token comment">#Pools</span>
<span class="token comment">#________________________________________________________________________________</span>
ltm pool <span class="token operator">/</span>Common<span class="token operator">/</span>pool<span class="token operator">-</span>fw1 <span class="token punctuation">{</span>
    members <span class="token punctuation">{</span>
        <span class="token operator">/</span>Common<span class="token operator">/</span>166.125.0.2:0 <span class="token punctuation">{</span>
            address 166.125.0.2
        <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
<span class="token punctuation">}</span>
<span class="token comment">#________________________________________________________________________________</span>
<span class="token comment">#iRules</span>
<span class="token comment">#________________________________________________________________________________</span>
ltm rule <span class="token operator">/</span>Common<span class="token operator">/</span>SSL_Forward_Proxy<span class="token operator">-</span>3_Rule <span class="token punctuation">{</span>
when CLIENTSSL_HANDSHAKE <span class="token punctuation">{</span>
<span class="token comment">###if { $DEBUG } { log local0. "[IP::client_addr]:[TCP::client_port] -> [IP::local_addr] $tls_servername --Decryption"}</span>
<span class="token comment">###if { $DEBUG } { HSL::send $hsl "[IP::client_addr]:[TCP::client_port] -> [IP::local_addr] $tls_servername --Decryption"}</span>
           LB::detach
           SSL::disable serverside
           virtual VS_443_Proxy<span class="token operator">-</span>2
<span class="token punctuation">}</span>
<span class="token punctuation">}</span>
<span class="token comment">#________________________________________________________________________________</span>
<span class="token comment">#Profiles</span>
<span class="token comment">#________________________________________________________________________________</span>
ltm profile client<span class="token operator">-</span>ssl <span class="token operator">/</span>Common<span class="token operator">/</span>ClientSSL_Profiles_nobypass <span class="token punctuation">{</span>
    app<span class="token operator">-</span>service none
    cert<span class="token operator">-</span>key<span class="token operator">-</span>chain <span class="token punctuation">{</span>
        __1 <span class="token punctuation">{</span>
            cert <span class="token operator">/</span>Common<span class="token operator">/</span>_.crt
            key <span class="token operator">/</span>Common<span class="token operator">/</span>_.key
            usage CA
        <span class="token punctuation">}</span>
        default <span class="token punctuation">{</span>
            cert <span class="token operator">/</span>Common<span class="token operator">/</span>default.crt
            key <span class="token operator">/</span>Common<span class="token operator">/</span>default.key
        <span class="token punctuation">}</span>
    <span class="token punctuation">}</span>
    cert<span class="token operator">-</span>lifespan 365
    defaults<span class="token operator">-</span>from <span class="token operator">/</span>Common<span class="token operator">/</span>clientssl
    hostname<span class="token operator">-</span>whitelist none
    inherit<span class="token operator">-</span>ca<span class="token operator">-</span>certkeychain false
    inherit<span class="token operator">-</span>certkeychain true
    ssl<span class="token operator">-</span>forward<span class="token operator">-</span>proxy enabled
    ssl<span class="token operator">-</span>forward<span class="token operator">-</span>proxy<span class="token operator">-</span>bypass enabled
<span class="token punctuation">}</span>
ltm profile server<span class="token operator">-</span>ssl <span class="token operator">/</span>Common<span class="token operator">/</span>ServerSSL_Profiles <span class="token punctuation">{</span>
    app<span class="token operator">-</span>service none
    ca<span class="token operator">-</span>file <span class="token operator">/</span>Common<span class="token operator">/</span>ca<span class="token operator">-</span>bundle.crt
    cipher<span class="token operator">-</span>group none
    ciphers ALL
    defaults<span class="token operator">-</span>from <span class="token operator">/</span>Common<span class="token operator">/</span>serverssl
    secure<span class="token operator">-</span>renegotiation request
    ssl<span class="token operator">-</span>forward<span class="token operator">-</span>proxy enabled
    ssl<span class="token operator">-</span>forward<span class="token operator">-</span>proxy<span class="token operator">-</span>bypass enabled
<span class="token punctuation">}</span>
<span class="token comment"># -Default Profile-</span>
ltm profile http http <span class="token punctuation">{</span>
    basic<span class="token operator">-</span>auth<span class="token operator">-</span>realm none
    lws<span class="token operator">-</span>width 80
    oneconnect<span class="token operator">-</span>transformations enabled
    oneconnect<span class="token operator">-</span>status<span class="token operator">-</span>reuse <span class="token string">"200 206"</span>
    proxy<span class="token operator">-</span>type reverse
    enforcement <span class="token punctuation">{</span>
        max<span class="token operator">-</span>header<span class="token operator">-</span>count 64
        max<span class="token operator">-</span>header<span class="token operator">-</span>size 32768
        pipeline allow
        <span class="token keyword">unknown</span><span class="token operator">-</span>method allow
    <span class="token punctuation">}</span>
    request<span class="token operator">-</span>chunking preserve
    response<span class="token operator">-</span>chunking selective
<span class="token punctuation">}</span>
<span class="token comment"># -Default Profile-</span>
ltm profile tcp tcp<span class="token operator">-</span>lan<span class="token operator">-</span>optimized <span class="token punctuation">{</span>
    ack<span class="token operator">-</span>on<span class="token operator">-</span>push enabled
    defaults<span class="token operator">-</span>from <span class="token operator">/</span>Common<span class="token operator">/</span>tcp<span class="token operator">-</span>legacy
    nagle disabled
    proxy<span class="token operator">-</span>buffer<span class="token operator">-</span>high 131072
    proxy<span class="token operator">-</span>buffer<span class="token operator">-</span>low 98304
    receive<span class="token operator">-</span>window<span class="token operator">-</span>size 65535
    send<span class="token operator">-</span>buffer<span class="token operator">-</span>size 65535
    slow<span class="token operator">-</span>start disabled
<span class="token punctuation">}</span>
2

muntae_kim You can absolutely perform SSL termination on other ports than 443. Please keep in mind that the client has to be using the HTTPS protocol over that other port so this wouldn’t work on lets say port 21 because that is for FTP or 22 because that is SSH without some fiddling with the client side of the connection. You would most likely use some free port that isn’t reserved for a specific protocol.

3

Thank you for answer. I would like to ask additional questions because I do not understand your answer.

Based on the current settings, the customer only wants to decrypt port 443, and is considering additional decryption of port 4430.

To make this possible, please review the following settings.

1. Add 4430 port Virtual Servers separately so that traffic flowing into 4430 port can be decrypted to the Virtual Servers that are currently set to port 443 only.
2. Modify and apply iRules to operate on a newly added Virtual Server

The conclusion is that when TCP 443 is set to 4430, a custom port, it is designated as Other, and whether it operates the same as 443.

If anyone has any clarity on this part, please respond.

thank you

4

muntae_kim You would configure a new virtual server listening on 4430 with an SSL profile and then send that decrypted traffic to your pool of choice. You do not have to send decrypted traffic back around to the virtual server listening on 443.