Otdfbt

Why is a common reference string needed in zero knowledge proofs?

Is it expected that a reader will skip parts of what you write?

What aircraft was used as Air Force One for the flight between Southampton and Shannon?

How is the excise border managed in Ireland?

Heap allocation on microcontroller

Is it a bad idea to to run 24 tap and shock lands in standard

Getting UPS Power from One Room to Another

Why 1,2 printed by a command in $() is not interpolated?

A map of non-pathological topology?

What to do when surprise and a high initiative roll conflict with the narrative?

Meaning of 'lose their grip on the groins of their followers'

US doctor working in Tripoli wants me to open online account

You have (3^2 + 2^3 + 2^2) Guesses Left. Figure out the Last one

Active low-pass filters --- good to what frequencies?

Artificer Creativity

What is the maximum number of net attacks that one can make in a round?

Why does the Mishnah use the terms poor person and homeowner when discussing carrying on Shabbat?

English word for "product of tinkering"

How to ensure color fidelity of the same file on two computers?

Writing an augmented sixth chord on the flattened supertonic

Warning about needing "authorization" when booking ticket

How does the Around command at zero work?

Why does Sin[b-a] simplify to -Sin[a-b]?

Is it legal for a bar bouncer to confiscate a fake ID

F5 SNI Passthrough

How to configure SNI so as to have benifits of SNISNI windows xp workaroundusing nginx with SNIStrict SNI matching for ApacheSSL SNI security concernsTLS SNI alternative in apachestunnel does not handle SNI correctlyStunnel with SNI: Section *name*: SNI section name not foundSNI Apache SSL CertificateSNI for a SMTP server

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

1

G'day all,

I'm trying to configure an F5 virtual Big-IP for L4 pass through SNI load balancing, but am having troubles (probably because I'm new to F5's).

We have backend websites that require SNI (due to co-hosting multiple applications on a small set of servers).

I'd like to load balance (provide HA more correctly) to those servers from the F5 at the L4/TCP level, i.e. no SSL termination, no requirement to upload individual site certificates onto the F5 (Certs are issued by an internal CA, the root/intermediate certs are already available and trusted).

I was able to get this working fairly easily in HAProxy using a config that looks like:

frontend https
 mode tcp
 tcp-request inspect-delay 5s
 use_backend api-uat if req_ssl_sni -i api-uat.mydomain 
 use_backend api-prod if req_ssl_sni -i api.mydomain 
 # repeat for other backends #

backend api-prod
 option httpchk GET / HTTP/1.1rnHost: api.mydomain 
 balance leastconn
 mode tcp

 server Server1 10.1.1.1:443 check check-ssl check-sni api.mydomain ca-file MyPKIRoot.pem
 server Server2 10.1.1.2:443 check check-ssl check-sni api.mydomain ca-file MyPKIRoot.pem

# repeat for other backends #

However the documentation on the F5 site is targeted at hosting using SNI (ie SSL termination on the F5, client profile ssl certs required).

Can any F5 gurus confirm if this is even possible? As a side note the SNI health check for the back end servers is woefully underpar too, but I'll get to that once I can get the virtual server working correctly :(

sni f5-big-ip

share|improve this question

edited May 23 at 23:09

Wokket

asked May 23 at 20:11

WokketWokket

62

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  support.f5.com/csp/article/K13385
  
  – Michael Hampton♦
  May 24 at 0:25
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks for that link, I hadn't found that yet. That does require "Importing the certificate and key pair that the destination server uses to the BIG-IP system." which I was hoping to avoid.
  
  – Wokket
  May 24 at 2:33
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Since the first post I've also found this page which seems to do what I need. I've implemented this and am correctly getting routed to my backend pools (per F5 logs and stats page), but I never get traffic back when I attempt to connect (through curl or openssl)... I don't know whether to open another question for that or continue here...
  
  – Wokket
  May 24 at 2:35
  

  
  
  
  

add a comment | 

1

G'day all,

I'm trying to configure an F5 virtual Big-IP for L4 pass through SNI load balancing, but am having troubles (probably because I'm new to F5's).

We have backend websites that require SNI (due to co-hosting multiple applications on a small set of servers).

I'd like to load balance (provide HA more correctly) to those servers from the F5 at the L4/TCP level, i.e. no SSL termination, no requirement to upload individual site certificates onto the F5 (Certs are issued by an internal CA, the root/intermediate certs are already available and trusted).

I was able to get this working fairly easily in HAProxy using a config that looks like:

frontend https
 mode tcp
 tcp-request inspect-delay 5s
 use_backend api-uat if req_ssl_sni -i api-uat.mydomain 
 use_backend api-prod if req_ssl_sni -i api.mydomain 
 # repeat for other backends #

backend api-prod
 option httpchk GET / HTTP/1.1rnHost: api.mydomain 
 balance leastconn
 mode tcp

 server Server1 10.1.1.1:443 check check-ssl check-sni api.mydomain ca-file MyPKIRoot.pem
 server Server2 10.1.1.2:443 check check-ssl check-sni api.mydomain ca-file MyPKIRoot.pem

# repeat for other backends #

However the documentation on the F5 site is targeted at hosting using SNI (ie SSL termination on the F5, client profile ssl certs required).

Can any F5 gurus confirm if this is even possible? As a side note the SNI health check for the back end servers is woefully underpar too, but I'll get to that once I can get the virtual server working correctly :(

sni f5-big-ip

share|improve this question

edited May 23 at 23:09

Wokket

asked May 23 at 20:11

WokketWokket

62

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  support.f5.com/csp/article/K13385
  
  – Michael Hampton♦
  May 24 at 0:25
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks for that link, I hadn't found that yet. That does require "Importing the certificate and key pair that the destination server uses to the BIG-IP system." which I was hoping to avoid.
  
  – Wokket
  May 24 at 2:33
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Since the first post I've also found this page which seems to do what I need. I've implemented this and am correctly getting routed to my backend pools (per F5 logs and stats page), but I never get traffic back when I attempt to connect (through curl or openssl)... I don't know whether to open another question for that or continue here...
  
  – Wokket
  May 24 at 2:35
  

  
  
  
  

add a comment | 

G'day all,

I'm trying to configure an F5 virtual Big-IP for L4 pass through SNI load balancing, but am having troubles (probably because I'm new to F5's).

We have backend websites that require SNI (due to co-hosting multiple applications on a small set of servers).

I'd like to load balance (provide HA more correctly) to those servers from the F5 at the L4/TCP level, i.e. no SSL termination, no requirement to upload individual site certificates onto the F5 (Certs are issued by an internal CA, the root/intermediate certs are already available and trusted).

I was able to get this working fairly easily in HAProxy using a config that looks like:

frontend https
 mode tcp
 tcp-request inspect-delay 5s
 use_backend api-uat if req_ssl_sni -i api-uat.mydomain 
 use_backend api-prod if req_ssl_sni -i api.mydomain 
 # repeat for other backends #

backend api-prod
 option httpchk GET / HTTP/1.1rnHost: api.mydomain 
 balance leastconn
 mode tcp

 server Server1 10.1.1.1:443 check check-ssl check-sni api.mydomain ca-file MyPKIRoot.pem
 server Server2 10.1.1.2:443 check check-ssl check-sni api.mydomain ca-file MyPKIRoot.pem

# repeat for other backends #

However the documentation on the F5 site is targeted at hosting using SNI (ie SSL termination on the F5, client profile ssl certs required).

Can any F5 gurus confirm if this is even possible? As a side note the SNI health check for the back end servers is woefully underpar too, but I'll get to that once I can get the virtual server working correctly :(

sni f5-big-ip

share|improve this question

edited May 23 at 23:09

Wokket

asked May 23 at 20:11

WokketWokket

62

frontend https
 mode tcp
 tcp-request inspect-delay 5s
 use_backend api-uat if req_ssl_sni -i api-uat.mydomain 
 use_backend api-prod if req_ssl_sni -i api.mydomain 
 # repeat for other backends #

backend api-prod
 option httpchk GET / HTTP/1.1rnHost: api.mydomain 
 balance leastconn
 mode tcp

 server Server1 10.1.1.1:443 check check-ssl check-sni api.mydomain ca-file MyPKIRoot.pem
 server Server2 10.1.1.2:443 check check-ssl check-sni api.mydomain ca-file MyPKIRoot.pem

# repeat for other backends #

share|improve this question

edited May 23 at 23:09

Wokket

asked May 23 at 20:11

WokketWokket

62

share|improve this question

edited May 23 at 23:09

Wokket

asked May 23 at 20:11

WokketWokket

62

asked May 23 at 20:11

WokketWokket

62

asked May 23 at 20:11

WokketWokket

62