201 · Question #301
Which statement is true concerning SSL termination?
The correct answer is A. A virtual server that has both ClientSSL and ServerSSL profiles can still support cookie persistence. A virtual server configured with both ClientSSL and ServerSSL profiles can still utilize cookie persistence because the BIG-IP decrypts the client-side traffic, allowing it to inspect and manipulate application-layer data like HTTP cookies.
Question
Which statement is true concerning SSL termination?
Options
- AA virtual server that has both ClientSSL and ServerSSL profiles can still support cookie persistence.
- BDecrypting traffic at the BIG-IP allows the use of iRules for traffic management, but increases the
- CWhen any virtual server uses a ClientSSL profile, all SSL traffic sent to the BIG-IP is decrypted before
- DIf a virtual server has both a ClientSSL and ServerSSL profile, the pool members have less SSL
How the community answered
(38 responses)- A74% (28)
- B8% (3)
- C13% (5)
- D5% (2)
Why each option
A virtual server configured with both ClientSSL and ServerSSL profiles can still utilize cookie persistence because the BIG-IP decrypts the client-side traffic, allowing it to inspect and manipulate application-layer data like HTTP cookies.
When a virtual server uses a ClientSSL profile, the BIG-IP decrypts the client's SSL traffic, making the HTTP headers and payload accessible for inspection and manipulation. Cookie persistence relies on reading and inserting HTTP cookies, which is possible once the traffic is decrypted by the ClientSSL profile, even if the traffic is subsequently re-encrypted to the server via a ServerSSL profile.
The statement is incomplete ("increases the") and therefore cannot be fully assessed as a true or false claim about SSL termination's impact on iRules and performance.
A ClientSSL profile only decrypts SSL traffic destined for the specific virtual server it is applied to, not all SSL traffic across the entire BIG-IP system.
If a virtual server uses a ServerSSL profile, the BIG-IP re-encrypts the traffic to the pool members, meaning the pool members still perform SSL decryption on their end, just from the BIG-IP instead of directly from the client, so they do not necessarily have less SSL processing.
Concept tested: BIG-IP SSL profiles and persistence interaction
Source: https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-implementations-12-1-0/4.html
Topics
Community Discussion
No community discussion yet for this question.