Forum Discussion

afara2000_1973's avatar
afara2000_1973
Icon for Nimbostratus rankNimbostratus
Sep 04, 2009

SSL persistence question

We have LTM 9.4.3 HF2. Trying to use LTM to load balance https requests to two websever nodes with SSL persistence in round robin fashion. There are two limitations:

 

 

1. LTM doesn't have the SSL certs.

 

2. Source IP address is NAT from a trusted site i.e., same source IP is used for all clients.

 

 

Q1. Can we have SSL persistence without terminating SSL on the F5?

 

 

Q2. If yes, do we still create Clientside SSL and Serverside SSL profiles with persistence settings but WITHOUT SSL certs?

 

 

Q3. If SSL persistence is not reliable or cannot be used, is there a sample code that implements https session persistence using other methods such as Universal persistence?

 

 

I appreciate your help.

 

 

Thanks,

 

Ali

 

 

 

 

2 Replies

  • Hi Ali,

     

     

    1. Yes (See: https://support.f5.com/kb/en-us/solutions/public/3000/000/sol3062.html)

     

    2. No--the certs are handled only on the client and server

     

    3. Only if you decrypt the SSL traffic on LTM using a client SSL profile

     

     

    Hope this gets you started.

     

     

    Aaron
  • Thanks Aaron. Will follow instructions to create a persistence profile of SSL type and see if both persistence and load balancing ocurrs. Thanks for your help.