# SSL Layer2 bridge in F5 **URL:** \ **Category:** Technical Forums\ **Tags:** ltm, application-delivery\ **Created:** [October 10, 2018, 11:35am UTC](https://community.f5.com/t/ssl-layer2-bridge-in-f5/59366 "2018-10-10T11:35:06Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![igorzhuk](https://avatars.discourse-cdn.com/v4/letter/i/b9bd4f/32.png) [@igorzhuk](https://community.f5.com/u/igorzhuk)\ **Post date:** [October 10, 2018, 11:35am UTC](https://community.f5.com/t/ssl-layer2-bridge-in-f5/59366/1 "2018-10-10T11:35:06Z")
Hi Can I define in a certain way SSL bridge in layer2 I need f5 to be inline traffic and ingress traffic from client side come to f5 and f5 egress this traffic with low ciphers without change Layer3 IP? ---
**Author:** ![Kevin\_Stewart](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/kevin_stewart/32/15267_2.png) [@Kevin\_Stewart](https://community.f5.com/u/Kevin_Stewart)\ **Post date:** [October 10, 2018, 1:52pm UTC](https://community.f5.com/t/ssl-layer2-bridge-in-f5/59366/2 "2018-10-10T13:52:10Z")
You can pass traffic through the BIG-IP, without changing layer 3 addresses, and without being in a layer 2 mode. The primary difference here is whether or not traffic **routes** through the F5, or the F5 is layer 2 transparent between routing devices. To do layer 3 (routed) mode without changing the IP addresses, - Create a wildcard VIP (0.0.0.0/0:443) - Disable address translation in the VIP - Don’t use SNAT in the VIP You can use a pool or simply define a gateway route. Your client-side route would then need to be the F5’s client-side VLAN self-IP. So client-side traffic routes through the BIG-IP, and no addresses change. It’s also worth noting that a source address is always left untouched unless SNAT is applied. The above prevents changing the destination address. ---
**Author:** ![Kevin\_Stewart](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/kevin_stewart/32/15267_2.png) [@Kevin\_Stewart](https://community.f5.com/u/Kevin_Stewart)\ **Post date:** [October 10, 2018, 3:15pm UTC](https://community.f5.com/t/ssl-layer2-bridge-in-f5/59366/3 "2018-10-10T15:15:50Z")
And if i want to create a layer2 transparent between routing devices how i can do that ? Sure, and you have a few options. - You can use **Transparent Nexthop** in v13.0: [Manipulating HTTPS Traffic by Using a Third-Party Device](https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-implementations-13-1-0/41.html) - You can use virtual wire on an i5800 series platform and above (v14.0) [Virtual Wires](https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/big-ip-tmos-routing-administration-14-0-0/02.html) - Or you can use a combination VLAN group and nexthop command in an iRule. In the first and third options, F5 is still a full proxy, but the nexthop allows it to mirror L2 headers on both sides. But perhaps the most robust option would be to deploy **SSL Orchestrator** , which would configure and L2 solution for you. ---
**Author:** ![Kevin\_Stewart](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/kevin_stewart/32/15267_2.png) [@Kevin\_Stewart](https://community.f5.com/u/Kevin_Stewart)\ **Post date:** [October 10, 2018, 3:34pm UTC](https://community.f5.com/t/ssl-layer2-bridge-in-f5/59366/4 "2018-10-10T15:34:19Z")
Virtual Wire doesn’t work in a vCMP guest, so that option is out. So transparent nexthop is probably you’re best bet when you get to 13.0, and the above link shows you how to set it up with an inspection device in the middle. This also assumes that the F5 is doing explicit decryption and re-encryption, and can therefore manage the TLS properties on each side. ---
**Author:** ![Saravanan\_M\_K](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/saravanan_m_k/32/5662_2.png) [@Saravanan\_M\_K](https://community.f5.com/u/Saravanan_M_K)\ **Post date:** [April 1, 2019, 2:03pm UTC](https://community.f5.com/t/ssl-layer2-bridge-in-f5/59366/5 "2019-04-01T14:03:41Z")
Hi Kevin, Virtual Wire doesn’t work in a vCMP guest Is it still true with v14.1.0.2? ---
**Author:** ![Kevin\_Stewart](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/kevin_stewart/32/15267_2.png) [@Kevin\_Stewart](https://community.f5.com/u/Kevin_Stewart)\ **Post date:** [April 1, 2019, 5:09pm UTC](https://community.f5.com/t/ssl-layer2-bridge-in-f5/59366/6 "2019-04-01T17:09:04Z")
Yes. It’s less a function of the software version and more to do with the underlying hardware that supports vWire. ---
**Author:** ![spalande](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/spalande/32/10043_2.png) [@spalande](https://community.f5.com/u/spalande)\ **Post date:** [October 20, 2022, 8:22am UTC](https://community.f5.com/t/ssl-layer2-bridge-in-f5/59366/7 "2022-10-20T08:22:14Z")
@Kevin_Stewart  - Is this possible to use advanced WAF for TLS applications for layer 2 deployment (with no selfIP at all)? F5 is deployment at edge inline to pass all traffic without any selfIP. Unfortunately, documents are not clear on how this will work as F5 needs to act as a proxy and should decrypt the traffic to use WAF, and also we would need to have application specific VIP and not wildcard ---
**Author:** ![Kevin\_Stewart](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/kevin_stewart/32/15267_2.png) [@Kevin\_Stewart](https://community.f5.com/u/Kevin_Stewart)\ **Post date:** [October 20, 2022, 11:48am UTC](https://community.f5.com/t/ssl-layer2-bridge-in-f5/59366/8 "2022-10-20T11:48:04Z")
Yes. vWire essentially sits underneath a fully proxy configuration to create layer 2 transparency. You would create a standard wildcard VIP with no address/port translation and no pool, then apply the vWire VLAN configuration. Add client/server SSL profiles if you need to handle encryption. [https://community.f5.com/t5/technical-articles/virtual-wire-configuration-and-troubleshooting/ta-p/291263](https://community.f5.com/topic/291263) ---
**Author:** ![spalande](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/spalande/32/10043_2.png) [@spalande](https://community.f5.com/u/spalande)\ **Post date:** [October 22, 2022, 10:38pm UTC](https://community.f5.com/t/ssl-layer2-bridge-in-f5/59366/9 "2022-10-22T22:38:00Z")
Thanks. we don’t need to use transparent next hop?  We have 3 diff ISPs and want to select all of them for ingress and egress traffic. How this can be achieved? I assume wildcard VIP would have some risks to configure, maintain and would be prone to some outages if mistakes are done in configuring. In my opinion we can configure app specific VIPs with destination same as application/server IP and would work as well. ---
**Author:** ![Kevin\_Stewart](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/kevin_stewart/32/15267_2.png) [@Kevin\_Stewart](https://community.f5.com/u/Kevin_Stewart)\ **Post date:** [October 24, 2022, 12:15pm UTC](https://community.f5.com/t/ssl-layer2-bridge-in-f5/59366/10 "2022-10-24T12:15:47Z")
Transparent and virtual wire are two different solutions to the same problem. BIG-IP is indeed a full proxy, so to perform layer 2 “bump-in-the-wire” processing, either of the two techniques is essentially used to copy the layer 2 headers from one side of the proxy to the other. Inside the proxy, above layer 2, you can still do TLS termination. The only things you really should not do in a layer 2 configuration is IP and port translation. So basically, you create a wildcard virtual server (0.0.0.0/0) with address and port translation disables, no pool, no SNAT, and apply a virtual wire VLAN group to that virtual server. You can, however, apply a source, destination, and/or port value to the virtual server, as these will act as filters for the traffic (vs. a termination point). So a virtual wire VIP with a source of 192.168.0.0/16, for example, would only accept traffic coming from that IP range.