ACE30 - Setting up SSL Termination for servers that aren't behind the ACE

[sgonsalv]

Hi Guys,

With the SSLM it was possible to use the SSLM to terminate SSL connections for servers that weren't behind the CSM, that is the servers could be anywhere within the data center.  This was done using PBR such that only traffic that only SSL traffic was directed to the SSLM for decryption and then on to the server.

Can this be done on the ACE30?  Where the servers aren't necessarily part of a subnet homed on the ACE30 module, rather they could be L3 reachable, but on another subnet within the data center?  If so, are there any documents with examples of how this can be setup?

thanks

Sheldon

[Andrew Nam · Accepted solution]

Hi Sheldon

I'm trying to understand your ssl termination setup with SSLM. Looks like you are doing frontend ssl termination with SSLM module and clear text between SSLM and servers via CSM but the servers are multi-hops away from the CSM.

If this is right understanding then short answer is YES, it is supported. The config is much simpler than CSM + SSLM but the only thing you need to consider is client source natting to make sure the ACE receives the return traffic. Otherwise, you will need to use the PBR to control the return traffic as you did with the CSM + SSLM set up.

For your understanding, please refer to below ssl sample config.

http://docwiki.cisco.com/wiki/Cisco_Application_Control_Engine_%28ACE%29_Configuration_Examples_--_SSL_Configuration_Examples

regards

Andrew

[sgonsalv]

Hi..

Thanks for the info. I've tested things and the SNATing of the client connection works well to ensure that the return traffic comes back to the ACE module

thanks

Sheldon