Throttle https virtual server requests, with non terminated ssl connections

Question

&nbsp;This is what I'd like to implement:  &nbsp;
&nbsp;---- https request ---- \              F5                  ----- https request --- \     Web server
&nbsp;---- client certificate - /    irule https Throttle   ---- client certificate -   / &nbsp;&nbsp;
&nbsp;I'm trying to use http throttle v10 and above: https://devcentral.f5.com/wiki/iRules.HTTP-Request-Throttle-version-10-1-and-above.ashx&nbsp;
&nbsp;Without ssl-termination, https virtual server doesn't work when applying an http profile.&nbsp;
&nbsp;This is the http-profile I'm using: &nbsp;&nbsp;
&nbsp;         ltm profile http /Partition1/profile_HTTP {
&nbsp;                  app-service none
&nbsp;                  defaults-from /Common/http
&nbsp;         }&nbsp;&nbsp;&nbsp;
&nbsp;Is it possible to throttle https request through irule https with non f5 ssl termination? &nbsp;
&nbsp;Is it possible to configure a http profile for a https virtual server? &nbsp;

john_matlock_42 · Answer

Eszer, 
&nbsp;  
&nbsp; Your diagram shows client certificate on both sites, I assume you're going to have an SSL profile on the F5 and bridge SSL?  You have to, at a minimum, have a server SSL profile on the HTTPS VIP in order to use the HTTP_REQUEST event in your iRule. 
&nbsp;  
&nbsp; Is it possible to throttle https request through irule https with non f5 ssl termination?  
&nbsp; SSL has to be terminated on the F5 for you to be able to use the HTTP events in an iRule.  You can, however, configure both a server and client side profile to keep the over-the-wire traffic encrypted. 
&nbsp; Is it possible to configure a http profile for a https virtual server?   
&nbsp; Yes 
&nbsp;  
&nbsp; John

eszer_28053 · Answer

&nbsp;Thanks John, but we already tried  terminating ssl connections in f5 and re-encrypt traffic, performance rate is unacceptable. &nbsp;
&nbsp;Too slow in  f5 ltm 1600...

john_matlock_42 · Answer

Thanks John, but we already tried  terminating ssl connections in f5 and re-encrypt traffic, performance rate is unacceptable.  
&nbsp;   
&nbsp;  
&nbsp; Eszer, 
&nbsp;  
&nbsp; Sorry to hear that.  If there is a security requirement to keep the traffic encrypted inside your network I'm afraid that I can't think of a way to do what you're looking for unless it is built into the application layer.  The F5 has to have the traffic decrypted in order for it to inspect layer 4+. 
&nbsp;  
&nbsp; Best of luck, 
&nbsp; John

eszer_28053 · Answer

thanks anyway, we'll have to make big changes on application layer

chris_miller · Answer

Posted By eszer on 04/27/2012 01:55 AM
&nbsp;
&nbsp;Thanks John, but we already tried  terminating ssl connections in f5 and re-encrypt traffic, performance rate is unacceptable. &nbsp;
&nbsp;Too slow in  f5 ltm 1600...

&nbsp;Can you provide more details on this? I've done this in multiple environments and haven't see any added latency or performance degradation. In reality, the ability to use a 2048-bit key on the client side while using a 1024-bit key on the server side should improve performance. Having the decryption done on commodity CPUs should never perform better.

Forum Discussion

Throttle https virtual server requests, with non terminated ssl connections

6 Replies

Recent Discussions

Failed to convert character dclid=%EDclid!

ASM - Parent policy vs OWASPcompliance

Rewrite uri translation not working

CONNECTION IS LOST DUE TO SELF IP IS DELIVERED

APM OCSP Responder Issues

Related Content

Distributed caching of authentication requests with NGINX Ingress Controller

FTPS_SSL_ Termination

LTM Pool Connections vs Requests

Logging DNS Requests

Troubeshooting website connection