Persistence profile with non-http traffic, zscaler, and SSL Passthrough
My latest roadblock is figuring out how to set up persistence when you can't use just about any of the persistance profiles. F5 LTM is going to be load balancing Microsoft Navision traffic across a server pool. The way Navision is setup is it's doing TCP and TLS communication to the cilent app via 7246. According to what I've learned in an early forum post, the F5 can't have TCP and TLS traffic on the same port, so I can't use SSL bridging, I have to use "Performace (Layer 4)" and just use SSL Passthrough. That's fine, it works. Now the problem is persistance. We use zScaler for our VPN/ZTNA. For all of our remote clients, the F5 essentially sees all the traffic as coming from our zScaler collector. Since the F5 sees all traffic as coming from, for example, 172.20.20.72 all the traffic is "load balanced" to the same server if we try to use source address. Same would be true for destination address. Cookie doesn't work becaue it's not HTTP traffic, MSRDP doesn't work because it's not RDP traffic, host doesn't work because it's not HTTP traffic, and the list goes on. I'm sure we can't be the only company using an F5 with zScaler so I'm sure someone else has the same issue? How did you overcome it? I think my answer may be using Hash or Universal but I don't understand iRules yet. I'm looking at them but it's not so straight forward. I think I should be able to create an iRule that would take the source IP and source port to create the persistence profile, but I lack any understanding of iRules at the moment.