301B: BIG-IP LTM Specialist: Maintain and TroubleshootDemo

By F5 · Question Mode

QuestionQ203

Identify and Resolve LTM Device Issues

Refer to the exhibit.

An LTM Specialist is troubleshooting an issue with an application configured on a BIG-IP LTM device. The application works correctly when accessed directly from the servers, but it fails when accessed through the LTM device.

The environment is configured as follows:

  • The virtual server is 192.168.1.211:443.
  • SNAT is enabled on the virtual server using the address 192.168.1.144.
  • The virtual server references a pool whose member is 192.168.10.80:443.
  • No Client SSL or Server SSL profile is currently associated with the virtual server.

Question Image

Which configuration change would allow the application to work correctly through the virtual server?

  • A Change pool member port to 8443.
  • B Change virtual server port to 8443.
  • C Add SSL off-loading to the pool member.
  • D Add Client and Server SSL profiles to the virtual server.
Explanation

Because both the virtual server and the pool member use port 443 (HTTPS), the traffic between the client and the LTM, and between the LTM and the pool member, is encrypted SSL/TLS traffic. Without a Client SSL profile, the BIG-IP cannot properly terminate/negotiate SSL with the client, and without a Server SSL profile it cannot re-encrypt and properly negotiate SSL with the backend pool member. Associating both a Client SSL profile and a Server SSL profile with the virtual server allows the BIG-IP to perform full SSL termination and re-encryption (or SSL bridging), which resolves the failure that occurs only when traffic passes through the LTM. Simply changing port numbers would not address the missing SSL negotiation, and there is no separate 'SSL off-load' setting applied directly to a pool member — SSL offloading is implemented via SSL profiles on the virtual server.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!