Solved

F5 BIG-IP SSL and non-SSL

Posted on 2011-09-28
3
341 Views
Last Modified: 2012-05-12


We are looking to implement a solution whereby users must use SSL to access a particular web app if they have the correct client cert. For users who don't have the cert yet we want the solution to automatically revert to use HTTP for this app and continue. We want it to be seamless to the user.

We plan on using the BIG-IP for the SSL termination at the perimeter.

Can the big-ip detect that the users machine doesn't have the cert and redirect to http? Or am I way off course here? Are there other ways to do this?
0
Comment
Question by:58872
3 Comments
 
LVL 83

Expert Comment

by:Dave Baldwin
ID: 36720776
You'll probably have to ask BIG-IP.  The general problem you are facing is that when you request an SSL connection, it gets negotiated First before anything else.  If it fails, you don't get anything but an error.  That would be normal.  Maybe BIG-IP can do something else.
0
 
LVL 16

Accepted Solution

by:
SteveJ earned 500 total points
ID: 36738638
Yes, you can redirect based on an SSL negotiation error. The problem is that will defeat the purpose of requiring a specific client cert unless you also filter on the source IP address. That is, 'sneaky pete' wants access to your app but doesnt have the appropriate cert. You end up effectively giving it to him.

What am I missing?

Steve
0
 

Author Closing Comment

by:58872
ID: 36960979
Thanks
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If your business is like most, chances are you still need to maintain a fax infrastructure for your staff. It’s hard to believe that a communication technology that was thriving in the mid-80s could still be an essential part of your team’s modern I…
When it comes to security, there are always trade-offs between security and convenience/ease of administration. This article examines some of the main pros and cons of using key authentication vs password authentication for hosting an SFTP server.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

919 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now