Centralized source IP for OCSP stapling traffic across partitions

Forums Technical Forums
, ,
1

Hello everyone,

I’m facing an architectural challenge with our OCSP stapling setup on the BIG-IP and would appreciate your input.

We are planning to configure OCSP stapling across multiple virtual servers and partitions. However, our security team has strict requirements regarding firewall rules:

We want all outgoing connections to external OCSP responders to leave the BIG-IP via a single, centralized source IP (for example, the Management IP or a dedicated source IP). The goal is to avoid having to create new firewall and proxy rules for every single Self-IP or partition whenever we add a new OCSP configuration. By default as far as we know, the BIG-IP uses the local Self-IP of the respective traffic group/subnet for outgoing OCSP traffic.

We looked into solving this via an HTTP proxy pool with a fixed egress address (as mentioned in F5 K75106155). However, that approach doesn’t really solve our core problem, it just shifts it, because we would still need to manage firewall/network rules between the individual BIG-IP Self-IPs and the proxy itself.

Has anyone tackled a similar requirement before? Is there a native way in TMOS to force all OCSP stapling traffic globally or centrally through one specific source IP without adding complexity across partitions?

Thanks in advance for any advice!

2

Hello Tobias,

I’m trying to understand your deployment a bit better, so I have a few questions:

  • How many partitions do you have, and does each one use its own route domain?
  • If so, is Strict Isolation enabled on those route domains?
  • Is this an HA pair, and are you using IPv4 only or IPv4/IPv6?

I’m not sure this will fully solve your problem, but it may be worth evaluating:

  1. Note that OCSP stapling is performed by TMM, so the requests cannot be sourced from the Management IP; they will always leave through a self IP.
  2. In /Common, create a dedicated VLAN (or route domain) with a self IP that has a route to the OCSP responders. This becomes your single egress point for firewall rules.
  3. In /Common, create one DNS resolver and one OCSP certificate validator (sys crypto cert-validator ocsp), setting its dns-resolver and route-domain to that dedicated egress path.
  4. Reference that same validator from the certificates in the Client SSL profiles in every partition. Objects in /Common can be referenced from other partitions, so new OCSP configurations would not require new firewall rules.

Before rolling it out, I would validate it in a lab with tcpdump to confirm the actual source IP, and in an HA pair, check which self IP each unit uses. Also, take a look at Bug ID 686626, which describes unexpected source IPs when the DNS resolver and the virtual servers are in different non-zero route domains.

Hope this helps.

Note: I used AI to help me with the translation.

Quiroman81