Forum Discussion

Arnaud_Ciron_12's avatar
Arnaud_Ciron_12
Icon for Nimbostratus rankNimbostratus
Dec 18, 2007

Beginner : How to create an iRule to monitor SSL traffic ?

Hi,

 

 

I'm new to iRule and BIGIP and we're using this box to terminate specific SSL connections (for credit cards equipments). Everything just works fine except I'd like to know :

 

1/ Why a connection was refused for some reasons.

 

2/ Who has terminated the SSL connection (which IP), because we're going to aggregtate thousands of connections and tcpdump is not appropriate.

 

3/ If possible : check the packet content after decryption.

 

 

I've search on the forum but still not found something useful so far.

 

 

Thanks in advance.
application delivery
dev
devops
iRules

3 Replies

Sort By
  • Arnaud_Ciron_12's avatar
    Arnaud_Ciron_12
    Icon for Nimbostratus rankNimbostratus
    Jan 18, 2008
    For a start, just a simple logging would be enough :

     

     

    How can I log successul SSL connections ?

     

    How can I log failed connections ?

     

     

    I've tried some code to log HTTP connection which is working fine :

     

     

    when CLIENT_ACCEPTED {

     

    log local0. "client: [IP::remote_addr]:[TCP::remote_port] -> dest: [IP::local_addr]:[TCP::local_port]"

     

    }

     

     

    But I use HTTP only for testing purpose. When setup will be complete I will have to monitor SSL connections only.

     

     

    Second problem : As far as I known logging to local0.* is written in /etc/var/tmm. We'll have thousand of connections going to that bigip and I wouldn't like to have not enough disk space. Instead I use a remote syslog server with this part of code inside syslog-ng.conf :

     

     

    Send messages to localhost through udp port 514

     

    destination d_remoteLogTunnel {

     

    udp ("x.x.x.x" port (514));

     

    };

     

     

    Performing logging

     

    log {

     

    source (local);

     

    filter (f_catchall);

     

    destination (d_remoteLogTunnel);

     

    };

     

     

    How can I send connections logging only to remote server ?
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jan 18, 2008
    In the syslog-ng.conf you can specify in your filter which events you want logged to which destination (local or remote) using 'match' and 'not match'.

     

     

    Take a look at this post from Tungstent as well as the overall thread for some additional info: (Click here).

     

     

    Aaron
  • Arnaud_Ciron_12's avatar
    Arnaud_Ciron_12
    Icon for Nimbostratus rankNimbostratus
    Feb 04, 2008
    Ok,

     

     

    I've managed to setup logging for successful connections.

     

     

    How about the failed connections ? As far as I known there is no event in iRules which could trigger an event when for example a SSL connection has failed ? (As a reminder I use a speciic TCP protocol, no HTTP here).

     

     

    Thanks in advance for your help