QuestionQ14

Identify the reason a virtual server is not working as expected

A BIG-IP Administrator has configured an SSL pass-through virtual server to load balance an application that uses SSL. After completing the configuration, the BIG-IP Administrator notices that the virtual server cannot pass traffic.

ltm virtual ssl_application_vs \{  
 destination 10.10.10.10:https  
 fallback-persistence source_addr  
 ip-protocol tcp  
 mask 255.255.255.255  
 persist \{  
  ssl \{ default yes  
  \}  
 \}  
 pool ssl_application_pool  
 profiles \{  
  http\{\}  
  tcp\{\}  
 \}  
 serverssl-use-sni disabled  
 source 0.0.0.0/0  
 source-address-translation \{  
  type automap  
 \}  
 translate-address enabled  
 translate-port enabled  
\}  

Which of the following causes the issue?

  • A http profile configured
  • B translate-address enabled configured
  • C ssl persistence profile configured
Explanation

SSL pass-through keeps the SSL/TLS payload encrypted end-to-end, so BIG-IP cannot apply an HTTP profile that expects readable HTTP messages. The virtual server should use a transport-layer profile such as TCP for pass-through traffic and omit the HTTP profile.

Community Discussion

No comments yet. Be the first to start the discussion!