topic Re: ACE and SSL termination in Application Networking

ACE and SSL termination

coldeneqt — Mon, 10 Aug 2009 00:10:54 GMT

Hi - Can the ACE pass SSL requests to a VIP and the real servers without the need to configure the ACE for SSL termination and initiation to teh backend servers ? Thank you.

Re: ACE and SSL termination

ciscocsoc — Mon, 10 Aug 2009 05:56:18 GMT

Hi,

Yes - you only need to terminate/reinitiate if you need to inspect or modify the underlying information in the SSL encapsulation. If you define the VIP to take SSL then it will be treated like any other TCP traffic.

HTH

Cathy

Re: ACE and SSL termination

coldeneqt — Mon, 10 Aug 2009 12:44:09 GMT

Thanks Cathy - I need to modify the VIP ACL to accept 443 and I need to add 443 to the rservers as well correct ? Thanks again.

Re: ACE and SSL termination

coldeneqt — Mon, 10 Aug 2009 13:07:26 GMT

Thanks Cathy - I added the following config but I still can not connect via https:

class-map match-all VIP

2 match virtual-address 10.1.1.1 tcp

eq https

serverfarm host SF

failaction purge

probe 443_PROBE

rserver SPWEBPRD1 443

inservice

rserver SPWEBPRD2 443

inservice

Re: ACE and SSL termination

Gilles Dufour — Mon, 10 Aug 2009 13:14:03 GMT

make sure there is no more generic class-map listed before this one in your multimatch policy.

Make the policy is on the correct interface.

Make sure serverfarm shows rservers alive.

Get a 'show service-policy detail' and check if you have any hit on the appropriate class-map.

Gilles.

Re: ACE and SSL termination

coldeneqt — Mon, 10 Aug 2009 14:34:37 GMT

Thank you - I got it to work by removing port 443 from the rservers in server farm config mode.

Also - Since all the traffic is sourced from the same ip address, will http cookie insert work in the https environment ? Thanks again.

Re: ACE and SSL termination

jteixido — Mon, 10 Aug 2009 16:56:18 GMT

I did not think that you needed to specify the ports in the reserver of the server-farm, if you have already specified the same port in the class-map.

In my case; I have traffic coming in the class-map in port 80 and I would have to redirect it to port 8109. I would than add port 8109 in the reservers in the server-farm.

If things are working for you, then my argument is a mute one.

John...

Re: ACE and SSL termination

coldeneqt — Mon, 10 Aug 2009 17:05:50 GMT

That sounds about right. I appreciate it.