201 · Question #193
A virtual server is configured to offload SSL from a pool of backend servers. When users connect to the virtual server, they successfully establish an SSL connection but no content is displayed. A…
The correct answer is B. disable Server SSL profile. When a virtual server is configured for SSL offloading, it decrypts client-side SSL and sends plain HTTP to backend servers. If no content is displayed, it indicates the BIG-IP is likely re-encrypting traffic to backend servers that expect HTTP.
Question
A virtual server is configured to offload SSL from a pool of backend servers. When users connect to the virtual server, they successfully establish an SSL connection but no content is displayed. A packet trace performed on the server shows that the server receives and responds to the request. What should a BIG-IP Administrator do to resolve the problem?
Options
- Aenable Server SSL profile
- Bdisable Server SSL profile
- Cdisable SNAT
- Denable SNAT
How the community answered
(38 responses)- A21% (8)
- B63% (24)
- C11% (4)
- D5% (2)
Why each option
When a virtual server is configured for SSL offloading, it decrypts client-side SSL and sends plain HTTP to backend servers. If no content is displayed, it indicates the BIG-IP is likely re-encrypting traffic to backend servers that expect HTTP.
Enabling the Server SSL profile would cause the BIG-IP to re-encrypt traffic to the backend servers, which are expecting unencrypted HTTP due to SSL offloading, leading to communication failure.
Disabling the Server SSL profile ensures that the BIG-IP sends decrypted, plain HTTP traffic to the backend servers, which is the correct behavior for SSL offloading when backend servers are not configured for SSL.
SNAT (Secure Network Address Translation) is used for source address translation and is unrelated to the SSL re-encryption issue causing no content to be displayed.
Enabling SNAT allows backend servers to route responses back through the BIG-IP, but it does not resolve the SSL handshake issue between the BIG-IP and the backend.
Concept tested: BIG-IP SSL offloading and Server SSL profile configuration
Source: https://techdocs.f5.com/en-us/big-ip-15-1-0/big-ip-system-ssl-administration/about-ssl-profiles.html
Topics
Community Discussion
No community discussion yet for this question.