Internet traffic today is encrypted at a rate of almost 90%. Our F5 Labs team wrote a TLS Telemetry Report last year that outlines several Internet-related encryption statistics. Also, Google serves up a page with near-real-time statistics related to Internet encrypted traffic. These reports show a staggering amount of encryption used across the Internet today.
While encryption is a great benefit to securing web traffic, it also presents a problem for inspecting that traffic. Many organizations need to send traffic through security devices/services to ensure they are not allowing malicious traffic into their network. But this presents a problem of organizing and managing encryption keys in addition to slowing down the user experience. In this video, John outlines these issues and explains why they are a problem. Stay tuned for more follow-up content showing how F5 can help solve this problem. Enjoy!
Nice introduction! You mentioned that another Lightboard Lesson is on the way. No to hard to figure out it will be about SSLO 🙂
If I may ask to include some info about this topics:
Is that mandatory to use two separate physical interfaces for each L2 service
Is there a way to easily add AWAF/DDoS L7 policies if Inbound SSLO is configured
Is there a way to add APM pre-authentication in case of Inbound SSLO
What is best practice to modify already configured Service Chains
When it makes sense to include any service in Non Intercept Chain - as far as I understand the idea, traffic processed by this chain is not decrypted so it seems to not make sense to include any service here?
@Piotr...great questions! I'll be sure to address them. By the way, what version of SSLO are you running? I can talk through these with recent versions, but if you have an older version, maybe I can take that into account as well. Thanks!
@Piotr, I recorded the SSLO video, but time constraints didn't allow me to dig into all the details you asked about. That said, I wanted to post answers here so you would have them (and others could see as well).
Is it mandatory to use two separate physical interfaces for each L2 service?
No, it's not necessary. It needs to be different L2 network, though.
Is there a way to easily add AWAF/DDoS L7 policies if Inbound SSLO is configured?
No, not currently within the SSLO managed UI interface.
Is there a way to add APM pre-authentication in case of Inbound SSLO?
You cannot do that in any of the releases prior to 5.1 from the SSLO UI. In 5.0 you would have 2 options: First, deploy normally and then disable the “Protected/Unprotected” lock; then modify the policy per your use in Access -> Per Request Policy. Second, you can define the policy outside first and then use that as a security policy.
What is best practice to modify already configured Service Chains?
In 5.0 you just have to modify the definition of the service chain. Go to service chain, select the service chain that you want to edit and follow the hyperlink (name).
When does it makes sense to include any service in Non Intercept Chain - as far as I understand the idea traffic processed by this chain is not decrypted so it seems to not make sense to include any service here?
