Forum Discussion

Yugandhar's avatar
Yugandhar
Icon for Nimbostratus rankNimbostratus
Oct 31, 2019

Reg VIP Forwarding using iRule.

Hi,   When we forward the request from a VIP that is listening on port 443 to a new VIP which is also listening on port 443 then :--   1. SSL Handshake negotiation happens with the 1st VIP a...
application delivery
iRules
LTM
Yugandhar's avatar
Yugandhar
Icon for Nimbostratus rankNimbostratus
Nov 02, 2019

Thank you Stanilas

  • Yugandhar's avatar
    Yugandhar
    Icon for Nimbostratus rankNimbostratus
    Nov 04, 2019

    Hi Stanislan,

     

    In this case SSL client profile would be applied to both VIPs.

     

    Could you also please tell me the message that the client web browser receives from the F5 (1st VIP) after the irule statement   virtual "/External/xyz.com--443" is executed ?

     

    Would like to know whether client receives a HTTP 302 ( redirect message ) or something else.

     

     

    Thanks,

    Yugandhar.

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Nov 04, 2019

    virtual command forward the TCP connection to new VS.

     

    there is no HTTP response.

     

    So if :

    • the outside virtual server has client side encryption configured (client ssl profile assigned)
    • he outside virtual server has client side has server side clear connection configured (no serverssl profile)
    • the inner virtual server has clientssl profile

     

    The client MUST initiate TLS handshake inside first TLS connection, which may not work....

     

    If you want to decrypt connection on the inner VS, you must have :

    • No Client SSL + Server SSL profiles assigned to the outside VS
    • Both Client SSL + Server SSL profiles assigned to the outside VS