Forum Discussion

DOTNWADM_174472's avatar
DOTNWADM_174472
Icon for Altostratus rankAltostratus
Jun 30, 2016

VS on https with offloading and pool on different port non ssl

We have a server which we configured in a pool and the server listens on port 7003, un-encrypted. We access the real server with the URL as http://:7003/

 

We need to configure a virtual server with ssl offloading on it so our requirement is to access the virtual server on url, https://.

 

We have been able to achieve this by making is a performance-l4, fast-http. But we could only get to reach http:// by which we are unable to achieve ssl offloading. When we choose performance-l4 & fast-http, we cannot get an option to configure the ssl certificate.

 

9 Replies

  • You need to be able to add "Client SSL Certificate" using the client-ssl profile for SSL offloading. I know it works well with Standard VS.

     

  • Odaah is correct, you need to do this with a standard virtual server.

     

    If I understand you correctly, you are trying to do a port 443 to port 7003 conversion? And the 7003 connection should be unencrypted, correct?

     

    If this is the case, you will need to create a pool for your servers using port 7003. Then you will create a virtual server using you VIP IP address. This services will listen on port 443. You'll need to assign it a HTTP profile, and then assign a client ssl profile with the certificate you want to use. Make the pool you defined above your default pool. Do not assign a server-side SSL profile.

     

    This should get you the 443 to 7003 port conversion with no encryption on the server side.

     

    • DOTNWADM_174472's avatar
      DOTNWADM_174472
      Icon for Altostratus rankAltostratus
      Hi Robert, Your understanding is correct. The steps mentioned by you have already been followed though without success.
    • Robert_Luechte1's avatar
      Robert_Luechte1
      Icon for Nimbostratus rankNimbostratus
      I'll be happy to help you work on this, but I'll need more information about what wasn't working. And if you can post the relevant configuration items, e.g. Pool, VS, Monitor, SSL Profile, it would be helpful.
  • Odaah is correct, you need to do this with a standard virtual server.

     

    If I understand you correctly, you are trying to do a port 443 to port 7003 conversion? And the 7003 connection should be unencrypted, correct?

     

    If this is the case, you will need to create a pool for your servers using port 7003. Then you will create a virtual server using you VIP IP address. This services will listen on port 443. You'll need to assign it a HTTP profile, and then assign a client ssl profile with the certificate you want to use. Make the pool you defined above your default pool. Do not assign a server-side SSL profile.

     

    This should get you the 443 to 7003 port conversion with no encryption on the server side.

     

    • DOTNWADM_174472's avatar
      DOTNWADM_174472
      Icon for Altostratus rankAltostratus
      Hi Robert, Your understanding is correct. The steps mentioned by you have already been followed though without success.
    • Robert_Luechte2's avatar
      Robert_Luechte2
      Icon for Cirrus rankCirrus
      I'll be happy to help you work on this, but I'll need more information about what wasn't working. And if you can post the relevant configuration items, e.g. Pool, VS, Monitor, SSL Profile, it would be helpful.
  • I don't know if you're doing SNAT-ing or not but are the "Address translation" and "port translation" check-boxes in the virtual server configuration enabled?

     

  • As others have been saying,

     

    What you're requesting is entirely possible - And you should have no issues with the configuration.

     

    Do you have any client facing TCPdumps - i.e. have you at least proven connectivity to the 443 VIP ?