201 · Question #224
A web server administrator informs the BIG-IP Administrator that web servers are overloaded Starting next month, the BIG-IP device will terminate SSL to reduce web server load. The BIG-IP device is re
The correct answer is A. Remove the server SSL profile and configure the Pool Members to use HTTP. To offload SSL from web servers when the BIG-IP is already terminating client SSL, the administrator should remove the server SSL profile and configure the pool members to receive unencrypted HTTP traffic.
Question
A web server administrator informs the BIG-IP Administrator that web servers are overloaded Starting next month, the BIG-IP device will terminate SSL to reduce web server load. The BIG-IP device is ready using client SSL client profile and Rules on HTTP level. What actions should the BIG-IP Administrators to achieve the desired configuration?
Options
- ARemove the server SSL profile and configure the Pool Members to use HTTP
- BRemove the client SSL profile and configure the Pool Members to US HTTP
- CRemove the chart SSL profile and change the Virtual Server to accept HTTP
- DRemove the server SSL profile and change the Virtual Server to accept HTTP traffic
How the community answered
(31 responses)- A77% (24)
- B13% (4)
- C3% (1)
- D6% (2)
Why each option
To offload SSL from web servers when the BIG-IP is already terminating client SSL, the administrator should remove the server SSL profile and configure the pool members to receive unencrypted HTTP traffic.
Since the BIG-IP already uses a client SSL profile to terminate client-side SSL, the web server overload from SSL implies the BIG-IP is re-encrypting traffic to the servers (SSL bridging). Removing the server SSL profile tells the BIG-IP to send plain HTTP to the pool members, thus offloading SSL processing entirely from the web servers.
Removing the client SSL profile would cause the BIG-IP to stop terminating SSL from clients, preventing the desired SSL offloading at the BIG-IP.
Removing the client SSL profile (assuming 'chart' is a typo for client) would stop BIG-IP from terminating client SSL, and changing the Virtual Server to accept HTTP would mean clients connect via HTTP, which is not the typical goal of SSL offloading at the BIG-IP.
Changing the Virtual Server to accept HTTP traffic means clients would connect via HTTP, which is not the intent when BIG-IP is meant to terminate SSL from clients; only the backend connection to pool members should be HTTP.
Concept tested: BIG-IP SSL Offloading configuration
Source: https://techdocs.f5.com/en-us/big-ip-local-traffic-management-concepts/understanding-ssl-offload.html
Topics
Community Discussion
No community discussion yet for this question.