We have the following config setup using two interfaces:
Client(.10.33) -- VLAN10 -- CSS -- VLAN10 -- Servers (.10.31, .10.32)
We have source-nating set up for the Client.
We are trying to set up content routing on an SSL flow, and hence need to use both front-end and back-end SSL for the flow.
I understand that the service IP and port must correspond to the server ip and port for the backend-server defined in the ssl-proxy list.
What should the VIP and Port of the backend-server be for this kind of backend-server? Can it be the same IP address as the server-IP and a different port number?
Does it have to match the HTTP port number for the backend content rule?
Also, does the backend-server need to be activated, or does the activation of the ssl-proxy-list do the job?
e.g.:
ssl-proxy-list ssllist1
ssl-server 252
ssl-server 252 vip address 192.168.10.252
ssl-server 252 port 443
ssl-server 252 cipher rsa-with-3des-ede-cbc-sha 192.168.10.252 8080
ssl-server 252 rsacert myrsacert1
ssl-server 252 rsakey myrsakey1
backend-server 31
backend-server 31 ip address 192.168.10.31
backend-server 31 port 17112
backend-server 31 server-ip 192.168.10.31
backend-server 31 server-port 7112
backend-server 31 cipher rsa-with-3des-ede-cbc-sha
backend-server 31 rsacert myrsacert1
backend-server 31 rsakey myrsakey1
backend-server 32
backend-server 32 ip address 192.168.10.31
backend-server 32 port 17122
backend-server 32 server-ip 192.168.10.31
backend-server 32 server-port 7122
backend-server 32 cipher rsa-with-3des-ede-cbc-sha
backend-server 32 rsacert myrsacert1
backend-server 32 rsakey myrsakey1
active
service sslulb3svr0
type ssl-accel
slot 6
keepalive type none
add ssl-proxy-list ssllist1
active
service ssluportal1-1
type ssl-accel-backend
keepalive type ssl
keepalive frequency 60
keepalive retryperiod 255
add ssl-proxy-list ssllist1
ip address 192.168.10.31
port 7112
active
The traffic is being blocked. Please tell us if we have the ssl config set up correctly.
