F5 Local traffic policy / wrong requirement!

Hi,

I worked on a customer deployment where we wanted to create a virtual server to dispatch HTTPS requests to internal virtual servers based on Host header.

In version 13.0, there is a condition

ssl-extension server-name

.I thought Great, I can create the main VS without HTTP profile and filter based SNI extension

So I tried to create a ltm policy with rules like:

• condition : Server name equals "mysite1.company.com"
• action : forward virtual server VS-mysite1.company.com

And tried to assign it to the VS with only ClientSSL profile. I can't because of policy requirements... When I looked in policy configuration in tmsh, the policy requires

http ssl-persistence

which is weird when I look the rule configuration.

In versions 11.X, this configuration was manual but starting with version 12, this is created automatically when selecting rule conditions and actions. I didn't checked if the requirements selected is also wrong in v12.

I so tried to create a policy and looked the generated configuration in TMSH

policy without rule

ltm policy Drafts/bug_policy_requires {
    last-modified 2017-08-28:18:36:02
    status draft
    strategy first-match
}

Policy with one rule assigning pool without condition

ltm policy Drafts/bug_policy_requires {
    controls { forwarding }
    last-modified 2017-08-28:18:37:17
    requires { http }
    rules {
        rule_no_condition {
            actions {
                0 {
                    forward
                    select
                    pool Pool_icap
                }
            }
        }
    }
    status draft
    strategy first-match
}

what configuration in this rule requires

http

???

Policy with one rule assigning pool and with SNI condition

ltm policy Drafts/bug_policy_requires {
    controls { forwarding }
    last-modified 2017-08-28:18:38:20
    requires { http ssl-persistence }
    rules {
        rule_condition_sni {
            actions {
                0 {
                    forward
                    select
                    pool pool_ad_http
                }
            }
            conditions {
                0 {
                    ssl-extension
                    ssl-client-hello
                    server-name
                    values { test.company.com }
                }
            }
            ordinal 1
        }
        rule_no_condition {
            actions {
                0 {
                    forward
                    select
                    pool Pool_icap
                }
            }
        }
    }
    status draft
    strategy first-match
}

Why

ssl-persistence

and not

client-ssl

condition which may be the best requirement?