cancel
Showing results for 
Search instead for 
Did you mean: 

HTTP Profile

Sushant
Altostratus
Altostratus

Is it mandatory to have SSL Profile if I have selected HTTP as my profile and on top of that selected virtual server standard type ?

1 ACCEPTED SOLUTION

Hello Sushant.

AWAF is able to protect web portal because it interprets and analyzes HTTP traffic searching for potential attacks. So, configuring a HTTP profile is mandatory. That means that you have to be able to interpret the whole set of OSI layers (from L4 to L7).

First question you have to ask you is:

Is my backend server (API server) using TLS?

​If the answer is yes, you have to put a server SSL profile in your VS.

Second question is:

Do I want to use TLS in my front-side communication for the VS?

If the answer is yes, so I also need to put a client SSL profile in my VS.

Remember that without SSL profiles, F5 won't be able to decrypt that trafffic and without decrypting it there is no WAF protection possible.

Regards,

Dario.

Regards,
Dario.

View solution in original post

8 REPLIES 8

Hello Sushant.

Actually, you can select each profile independently. But if your communication has TLS it will fail.

You should understand the F5 profiles as OSI layers that are interpreted by the device. So, you cannot understand HTTP layer (with an HTTP profile) if you didn't decrypt your flow first (with a SSL Profile).

Regards,

Dario.

Regards,
Dario.

Hello Dario,

 

 

Thank you for the reply .Lets take an example. I have selected Standard Virtual server with L4 profile as TCP and Application profile as HTTP both on the client and server side. In this case I have not used SSL profile but tend to open my application directly using public IP ...shouldn't it work ? in my case it is not working.....

 

The real scenario is I have an API that communicates with a public IP directly not with any specific domain and my API also directly has an IP with no domain associated. I would like to use AWAF, DOS, Bot profile with it and as you are well aware AWAF,DOS and BOT profile doesn't work until we associate HTTP profile with it .In the case of standard virtual server, I came to find out that if I use HTTP as my profile it is compulsory to use SSL profile otherwise it simply wont work. In my case there is no SSL profile. So, how can i make my security profile working without using HTTP profile ?

Hello Sushant.

AWAF is able to protect web portal because it interprets and analyzes HTTP traffic searching for potential attacks. So, configuring a HTTP profile is mandatory. That means that you have to be able to interpret the whole set of OSI layers (from L4 to L7).

First question you have to ask you is:

Is my backend server (API server) using TLS?

​If the answer is yes, you have to put a server SSL profile in your VS.

Second question is:

Do I want to use TLS in my front-side communication for the VS?

If the answer is yes, so I also need to put a client SSL profile in my VS.

Remember that without SSL profiles, F5 won't be able to decrypt that trafffic and without decrypting it there is no WAF protection possible.

Regards,

Dario.

Regards,
Dario.

Hello Dario,

 

Thank you replying back...

 

Yes I did get your point and in order to use TLS as per my understanding a domain name must be there with their associated DNS record. But in my particular case API has only IP associated (no domain) with it which communicates using a layer2 MPLS link that means there wont be any domain associated with it as there will direct communication using IP over MPLS.

The API is plainly working on HTTP as well so SSL profile is not required as well.

 

Is there any workaround for these kind of scenarios where I could be using all security profiles ?

 

 

 

Hello Sushant.

I guess you are mixing concepts.

TLS has different features:

  • Authentication
  • Key Exchange
  • Encryption
  • Integrity

REF - https://youtu.be/ZM3tXhPV8v0

And you require a domain name and a DNS entry just for the authentication step, which is not related with the encryption step.

Said that, you have two chances:

- Enabling WAF protection: TCP, SSL and HTTP profiles are required

- Not enabling WAF protection: just the TCP profile is required.

Regards,

Dario.

Regards,
Dario.

Can I use security profile If i have a vm running HTTP only not HTTPS ?

 

as per my understanding under HTTP communication will be plain text no encryption no authentication nothing...so it doesnt require SSL inspection as well..

Sure, you can.

Regards,
Dario.

thanks Dario !