Lab 3: SSL Offload and Security

In this Lab we will configure client side SSL processing on the BIG-IP.

Objective:

• Create a self-signed certificate

• Create a client SSL profile

• Modify your HTTP virtual server to use HTTPS

• Add additional security to your HTTPS web server using the HTTP profile

We will create a self-signed certificate and key and a SSL client profile to attach to our virtual server.

Creating a Self-signed certificate and key

1. Go to System >> Certificate Management >> Traffic Certificate Management >> SSL Certificates List and select Create

   

   This will take you to Local Traffic >> SSL Certificates >> New SSL Certificate…

   1. Please note the default key size is 2048, you can save SSL resources on the server-side by lowering this key size.

      

   2. Enter:

      1. Name: my-selfsigned-cert

      2. Issuer: Self

      3. Common Name: www.f5demo.com

      4. Fill out the rest any way you would like and then click Finished.

Creating SSL Client Profile

1. Go to Local Traffic >> Profiles >> SSL >> Client menu and select Create.

   

   1. Under General Properties

      1. Name: my_clientssl_profile

   2. Under Configuration in the Certificate Key Chain section, select the Custom box and hit Add.

      1. In the Add SSL Certificate to Key Chain pop-up select:

      1. Certificate:         my-selfsigned-cert

      2. Key:                     my-selfsigned-cert

      2. Select Add

      

   3. Hit Finished.

Building our New Secure Virtual Server

1. Go to Local Traffic >> Virtual Servers and hit the Create button or hit the “+” next to Virtual Servers

   1. Name: secure_vs

   2. Destination Address/Mask: 10.1.10.105

   3. Port: 443 or HTTPS

   4. SSL Profile (Client): my_clientssl_profile (the profile you just created)

   5. Source Address Translation: Auto Map (remember why we need this?)

   6. Default Pool: www_pool

   7. Default all other settings. (Notice you did not require an HTTP profile)

   8. Finish

2. Testing our secure server.

   • UDF - Go to your RDP session and browse to secure_vs at https://10.1.10.105

   1. If you want to watch member traffic, go to the www_pool and reset the statistics.

   2. Browse to your secure virtual server

   3. What port did your pool members see traffic on?

Securing web applications with the HTTP profile

1. Let’s begin by creating a custom HTTP profile.

   1. Go to Local Traffic >> Profiles >> Services, by default you are in HTTP profiles, click Create and generate a new profile

   2. Under General Properties

      1. Name: secure-my-website

   3. Under Settings use Custom settings and modify the following:

      1. Set the Fallback Host: https://www.f5.com (this will take you an alternate site)

      2. Fallback on Error Codes: 404 (fallback site if a 404 error is received)

      3. Response Headers Allowed: Content-Type Set-Cookie Location

      4. Insert XForwarded For: Enabled (to save the original client ip)

      

   22. Select Finish

   6. Attach your new HTTP Profile to your secure_vs (HTTPS) virtual server by going to the virtual server, selecting the HTTP Profile and changing it from None to secure-my-website.

2. Browse to your secure virtual server in RDP session.

   1. Do web pages appear normal?

   2. Now browse to a bad page.

   3. Using your browser Inspect window check the server response. Alternatively you can go to the Request and Response Headers from the Demo drop-down menu to view the headers. You should see your sanitized server response and the original client IP address in the x-forward-for header, which is itself new.

   4. You can compare the headers by accessing your HTTP virtual server your unsecure www_vs and looking at the responses.

Note

Even though the data is encrypted between your browser and the virtual server, the LTM can still modify the data (i.e. resource cloaking) because the data is unencrypted and decompressed within TMOS.