1

G'day all,

I'm trying to configure an F5 virtual Big-IP for L4 pass through SNI load balancing, but am having troubles (probably because I'm new to F5's).

We have backend websites that require SNI (due to co-hosting multiple applications on a small set of servers).

I'd like to load balance (provide HA more correctly) to those servers from the F5 at the L4/TCP level, i.e. no SSL termination, no requirement to upload individual site certificates onto the F5 (Certs are issued by an internal CA, the root/intermediate certs are already available and trusted).

I was able to get this working fairly easily in HAProxy using a config that looks like:

frontend https
    mode tcp
    tcp-request inspect-delay 5s
    use_backend api-uat if { req_ssl_sni -i api-uat.mydomain }
    use_backend api-prod if { req_ssl_sni -i api.mydomain }
    # repeat for other backends #

backend api-prod
    option httpchk GET / HTTP/1.1\r\nHost:\ api.mydomain 
    balance leastconn
    mode tcp

    server Server1 10.1.1.1:443 check check-ssl check-sni api.mydomain ca-file MyPKIRoot.pem
    server Server2 10.1.1.2:443 check check-ssl check-sni api.mydomain ca-file MyPKIRoot.pem

# repeat for other backends #

However the documentation on the F5 site is targeted at hosting using SNI (ie SSL termination on the F5, client profile ssl certs required).

Can any F5 gurus confirm if this is even possible? As a side note the SNI health check for the back end servers is woefully underpar too, but I'll get to that once I can get the virtual server working correctly :(

Wokket
  • 11
  • 3
  • https://support.f5.com/csp/article/K13385 – Michael Hampton May 24 '19 at 00:25
  • Thanks for that link, I hadn't found that yet. That does require "Importing the certificate and key pair that the destination server uses to the BIG-IP system." which I was hoping to avoid. – Wokket May 24 '19 at 02:33
  • 1
    Since the first post I've also found [this page](https://devcentral.f5.com/s/articles/sni-based-pool-selection-without-clientssl-profile-1119) which seems to do what I need. I've implemented this and am correctly getting routed to my backend pools (per F5 logs and stats page), but I never get traffic _back_ when I attempt to connect (through curl or openssl)... I don't know whether to open another question for that or continue here... – Wokket May 24 '19 at 02:35

0 Answers0