Forum Discussion

Altostratus

Mar 28, 2023

Solved

SSLO HTTPS conversion to HTTP for NGFW inspection

Hi all, I am new to the bigip SSLO and I was playing around it in order to see if I can enhance my NGFW visibility instead of moving to a bigger box. The BIGIP has been moved as the default gateway...

Stephan_Schulz
Mar 28, 2023
Hi,

this is the use case for which the SSLO is build for, so yes it is (easy) possible to do this. In this case, the NGFW is just a service (inspection) device and SSLO will forward traffic based on your policy. There is one thing to consider in how to positioning the SSLO and NGFW. Is this NGFW the internet facing device with NAT, VPN, etc? If yes, it is a bit more complex as you can't move the device into the inspection zone completely.

From a SSLO perspective (best prectise) all inspection devices are hidden and isolated within a dedicated inspection zone and only the SSLO can forward traffic to them. It would be best to use a separate or a virtual instance of your NGFW as inspection device. Otherwise you can use PBR to steer the the traffic.

client --> (https) SSLO --> (http) NGFW --> (http) SSLO --> (https) NGFW --> (https) internet

The SSLO itself can be integrated as a L2 or a L3 device and it can work as a transparent or an explicit proxy. This really depends on your architecture or use case. You can find more details here: https://clouddocs.f5.com/sslo-deployment-guide/

Cheers
Stephan

Konstantinos_Be

Altostratus

Apr 03, 2023

Dear all,

After further troubleshooting it has been found that the decryption is working.

The flow is decrypted and sent over the original port, hence the port 443.

Thank you for the support and quick feedback.

Best Regards

Konstantinos

Stephan_Schulz

Employee

Apr 04, 2023

Hi,

ah yes, this can happen. It is a (recommended) option for the service device to use "port remap" to change the port to 80 (at least to something different than 443).