Ssl offloading

If you consider that client SSL allows the F5 to be the server side of the SSL session, from the client to the F5, the a server SSL profile allows the F5 to be the client side element of the SSL session between the F5 and the backend server. To apply a server SSL profile means that traffic will be encrypted between the F5 and the server. Your servers would then need to expect SSL and very likely need to be listening on port 443.

Your conclusions about the Clientside SSL profile are correct. I'm only adding that when you map a serverside SSL profile to your Virtual Server, F5 (re)encrypts the traffic flow, before sending the request to end-server. It's an extra layer of security indeed. In some business sectors and jurisdictions, regulatory requirements oblige customers to encrypt the entire traffic flow from end-server to end-customer. In such cases, you have no choice. In all other cases it's up to you. What do you value more - performance and ease of management, or additional security?

Your questions:

Also if we are using the ssl profiles ..we creatr virtual server on port 443 .what port should the web service be running ??http ??

If ssl server profile is used, can we use the pool members to be on port 443??

1. If do not want to encrypt the traffic flow between BigIP and end-server, but do want to do so for the traffic between BigIP and end-customer, you can use port TCP 443 for your Virtual Server listener and port TCP 80 (or 8080, or any other standard non-SSL HTTP port) for your Pool Members.
2. If you want SSL between BigIP and end-server as well as between BigIP and end-customer, you should use TCP 443 for Virtual Server listener and port 443 (or 8443, or any other standard SSL-enabled HTTP port) for your Pool Members.

Hi Hannes,

If we want SSL between BIGIP and end-server as well as between BigIP and end-customer then we need to use both client-SSL profile and server-SSL profile rite..?