SSL offload not working

Question

I have configured VIP with https with back end services port http. When i apply SSL Client profile i dont have any issue and able to access the url. When apply the SSL Server Profile (applied default as serverssl) the url is not working and it says Page cant be displayed. Can you please help me what may be the issue, do we need to do any other settings or do the client has to do any thing on server end? the Server is running with Windows 2012 IIS. Please do the needful ASAP.&nbsp;
Just FYI: The goal is client want the traffic between F5 to back end server also need to encrypt. for that I had applied the SSL Server Profile as serverssl&nbsp;

nathe · Answer

Yes, the default serverssl profile should work. 
I have configured VIP with https with back end services port http
You will need to configure the backend server to accept secure (443) connections, however.
Hope this helps.
N

nitass_89166 · Answer

can you post the virtual and pool configuration?
 tmsh list ltm virtual (name)
 tmsh list ltm pool (name)

nitass · Answer

can you post the virtual and pool configuration?
 tmsh list ltm virtual (name)
 tmsh list ltm pool (name)

mk_167350 · Answer

Thanks for quick response, Here is the output

ltm virtual reporting-qa_https {
    description "reporting-qa HTTPS VIP"
    destination 172.24.1.8:https
    ip-protocol tcp
    mask 255.255.255.255
    persist {
        reporting_ssl_persist {
            default yes
        }
    }
    pool reporting_http_Pool2
    profiles {
        reporting-qa {
            context clientside
        }
        http { }
        serverssl {
            context serverside
        }
        tcp { }
    }
    source 0.0.0.0/0
    source-address-translation {
        pool reporting_SNATPool
        type snat
    }
    vs-index 15
}

ltm pool reporting_http_Pool2 {
    load-balancing-mode least-connections-member
    members {
        172.24.1.11:http {
            address 172.24.1.11
            session user-disabled
            state down
        }
        172.24.1.12:http {
            address 172.24.1.12
            session monitor-enabled
            state up
        }
    }
    monitor http 
}

mk_167350 · Answer

Thanks for quick response, Here is the output

ltm virtual reporting-qa_https {
    description "reporting-qa HTTPS VIP"
    destination 172.24.1.8:https
    ip-protocol tcp
    mask 255.255.255.255
    persist {
        reporting_ssl_persist {
            default yes
        }
    }
    pool reporting_http_Pool2
    profiles {
        reporting-qa {
            context clientside
        }
        http { }
        serverssl {
            context serverside
        }
        tcp { }
    }
    source 0.0.0.0/0
    source-address-translation {
        pool reporting_SNATPool
        type snat
    }
    vs-index 15
}

ltm pool reporting_http_Pool2 {
    load-balancing-mode least-connections-member
    members {
        172.24.1.11:http {
            address 172.24.1.11
            session user-disabled
            state down
        }
        172.24.1.12:http {
            address 172.24.1.12
            session monitor-enabled
            state up
        }
    }
    monitor http 
}

Forum Discussion

SSL offload not working

9 Replies

Recent Discussions

minimum tmos software version for connect CIS (openshift)

Chrome V 124+ on MacOS - Virtual Server Access Issue

F5 Rseries HA

Need advise to setup a policy on F5

F5 Rseries R2600 Tenant sizing

Related Content

SSL Offload with HTTP/2.0

How Proxy SSL works on BIG-IP

SSL Offloading for specific IPs or range of IPs

F5 SSL Offload behind Nginx Reverse Proxy

F5 Synthesis: Hybrid SSL Offload