Forum Discussion

Robert_47833's avatar
Robert_47833
Icon for Altostratus rankAltostratus
Mar 20, 2015
Solved

SSL cipher: improve performance

In my company,there are tons of ssl traffic(both client and server side in LTM).   In order to tunning this,which SSL cipher I should choose to improve performance and reduce latency spent in netw...
application delivery
LTM
performance
  • Hannes_Rapp_162's avatar
    Hannes_Rapp_162
    Mar 20, 2015

    In regards to F5 config, the most significant performance improvement would come from well-optimized caching profiles, this goes for SSL and nonSSL traffic. In my opinion, forcing the use of a specific "performance-friendly" cipher is a pseudo-improvement, it would improve performance very little to nothing, furthermore, it could cut off some users who have a device which does not support your cipher.

     

    To conclude:

     

    1) Take a look at your caching profiles

     

    2) Ask the front-end team to reduce the amount of GET requests a browser has to make per page load

     

    Good luck :)

     

    Note: The oneconnect would indeed reduce the SSL handshakes for LTM to backend server communications. One thing to keep in mind that with this option enabled, you might also want to configure X-Forwarded-For HTTP header, so that the original source IP address of request-maker can be seen in the back-end server logs.

     

Hannes_Rapp_162's avatar
Hannes_Rapp_162
Icon for Nacreous rankNacreous

In regards to F5 config, the most significant performance improvement would come from well-optimized caching profiles, this goes for SSL and nonSSL traffic. In my opinion, forcing the use of a specific "performance-friendly" cipher is a pseudo-improvement, it would improve performance very little to nothing, furthermore, it could cut off some users who have a device which does not support your cipher.

 

To conclude:

 

1) Take a look at your caching profiles

 

2) Ask the front-end team to reduce the amount of GET requests a browser has to make per page load

 

Good luck :)

 

Note: The oneconnect would indeed reduce the SSL handshakes for LTM to backend server communications. One thing to keep in mind that with this option enabled, you might also want to configure X-Forwarded-For HTTP header, so that the original source IP address of request-maker can be seen in the back-end server logs.

 

Robert_47833's avatar
Robert_47833
Icon for Altostratus rankAltostratus
Mar 20, 2015
What is best way to set up cache profile? There is CDN Akamai to provide cache in front end ,I am thinking about improve backend F5's performance which serve dynamic content mostly