3. Create a Transparent Forward Proxy SSLO

The majority of enterprise forward proxy configurations will involve a single or HA pair of F5 platforms performing the SSL visibility task. The SSL Orchestrator has been designed with that principle in mind and performs robust and dynamic service chaining of security devices.

SSL Orchestrator makes configuration of a single-box deployment simple and intuitive. Please follow the steps below to create a transparent forward proxy SSL Orchestrator configuration.

• 3.1. Login and review the UDF lab hosts and endpoints
• 3.2. Review the default SSL Orchestrator pre-requisites
• 3.3. Begin creating the initial deployment via Guided Configuration
  • 3.3.1. Initialization
  • 3.3.2. Configuration review and prerequisites
• 3.4. Guided configuration Topology
• 3.5. Guided configuration SSL Configuration
  • 3.5.1. Client-side SSL
  • 3.5.2. Server-side SSL
• 3.6. Guided configuration Authentication
• 3.7. Guided configuration Service
  • 3.7.1. ICAP service
• 3.8. Guided configuration Service Chain
• 3.9. Guided configuration Security Policy
  • 3.9.1. Security policy
• 3.10. Guided configuration Interception Rule
• 3.11. Guided configuration Egress Setting
• 3.12. Guided configuration Log Settings
• 3.13. Guided configuration Summary
• 3.14. Review behavior prior to decryption
  • 3.14.1. RDP to the Client machine
  • 3.14.2. Server certificate test
  • 3.14.3. Encrypted traffic test on the security service
• 3.15. Enable decryption and test behavior
  • 3.15.1. Enable decryption within the security policy
  • 3.15.2. Server certificate test
  • 3.15.3. Decrypted traffic test on the security service
• 3.16. Configure and test selective decryption by URL category
  • 3.16.1. Enable SSL bypass
  • 3.16.2. Financial and medical site test
• 3.17. View dashboard
• 3.18. Add the remaining services (optional - time permitting)
  • 3.18.1. Inline layer 2 service
  • 3.18.2. Inline layer 3 service
  • 3.18.3. Inline HTTP service
  • 3.18.4. TAP service
• 3.19. Associate new services to service chains (optional - time permitting)
• 3.20. Test the new TAP service (optional - time permitting)