8

Configuring an SSL Accelerator

• Introducing the SSL Accelerator
• Configuring the SSL Accelerator
• Introducing the SSL accelerator scalable configuration
• Additional configuration options

Introducing the SSL Accelerator

The SSL Accelerator feature allows the BIG-IP Controller to accept HTTPS connections (HTTP over SSL), connect to a web server, retrieve the page, and then send the page to the client.

A key component of the SSL Accelerator feature is that the BIG-IP Controller can retrieve the web page using an unencrypted HTTP request to the content server. With the SSL Accelerator feature, you can configure an SSL gateway on the BIG-IP Controller that decrypts HTTP requests that are encrypted with SSL. Decrypting the request offloads SSL processing from the servers to the BIG-IP Controller. This also allows the BIG-IP Controller to use the header of the HTTP request to intelligently control how the request is handled.

When the SSL gateway on the BIG-IP Controller connects to the content server, it uses the original client's IP address and port as its source address and port, so that it appears to be the client (for logging purposes).

This chapter describes the following features of the BIG-IP Controller SSL Accelerator:

• Configuring an SSL Accelerator
• Enabling and disabling an SSL Accelerator
• Viewing the configuration of an SSL Accelerator
• Using an SSL Accelerator scalable configuration

Note: All products except the BIG-IP LoadBalancer, BIG-IP FireGuard Controller, and the BIG-IP Cache Controller support this configuration.

Figure 8.1 An incoming SSL connection received by an SSL Accelerator configured on BIG-IP Controller

Configuring the SSL Accelerator

There are several steps required to set up the SSL Accelerator on the BIG-IP Controller. These steps include:

• Generating a key and obtaining a certificate
• Configuring the BIG-IP Controller with the certificate and key
• Creating an HTTP virtual server
• Creating the gateway for the SSL Accelerator

Generating a key and obtaining a certificate

In order to use the SSL Accelerator feature you must obtain a valid x509 certificate from an authorized certificate authority (CA). The following list contains some companies that are certificate authorities:

• Verisign (http://www.verisign.com)
• Digital Signature Trust Company (http://secure.digsigtrust.com)
• GlobalSign (http://www.globalsign.com)
• GTE Cybertrust (http://www.cybertrust.gte.com)
• Entrust (http://www.entrust.net)
  
  

  You can generate a key, a temporary certificate, and a certificate request form with the Configuration utility or from the command line.

  Note that we recommend using the Configuration utility for this process. The certification process is generally handled through a web page. Parts of the process require you to cut and paste information from a browser window in the Configuration utility to another browser window on the web site of the CA.

Additional information about keys and certificates

You must have a separate certificate for each domain name on each BIG-IP Controller or redundant pair of BIG-IP Controllers, regardless of how many non-SSL web servers are load balanced by the BIG-IP Controller.

If you are already running an SSL server, you can use your existing keys to generate temporary certificates and request files. However, you must obtain new certificates if the ones you have are not for the following web server types:

• Apache + OpenSSL
• Stronghold

Generating a key and obtaining a certificate using the Configuration utility

To obtain a valid certificate, you must have a private key. If you do not have a key, you can use the Configuration utility on the BIG-IP Controller to generate a key and a temporary certificate. You can also use the Configuration utility to create a request file you can submit to a certificate authority (CA). You must complete three tasks in the Configuration utility to create a key and generate a certificate request.

• Generate a certificate request
• Submit the certificate request to a CA and generate a temporary certificate
• Install the SSL certificate from the CA
  
  

  Each of these tasks is described in detail in the following paragraphs.

To create a new certificate request using the Configuration utility

1. In the navigation pane, click Proxies.
   The Proxies screen opens.
2. On Proxies screen, click the Create SSL Certificate Request tab.
   The New SSL Certificate Request screen opens.
3. In the Key Information section, select a key length and key file name.
   
   

   · Key Length
   Select the key length you want to use for the key. You can choose either 512 or 1024 bytes.

   · Keyfile Name
   Type in the name of the key file. This should be the fully qualified domain name of the server for which you want to request a certificate. You must add the .key file extension to the name.

4. In the Certificate Information section, type the information specific to your company. This information includes:
   
   

   · Country
   Type the two letter ISO code for your country, or select it from the list. For example, the two-letter code for the United States is US.

   · State or Province
   Type the full name of your state or province, or select it from the list. You must enter a state or province.

   · Locality
   Type the city or town name.

   · Organization
   Type the name of your organization.

   · Organizational Unit
   Type the division name or organizational unit.

   · Domain Name
   Type the name of the domain upon which the server is installed.

   · Email Address
   Type the email address of a person who can be contacted about this certificate.

   · Challenge Password
   Type the password you want to use as the challenge password for this certificate. The CA uses the challenge password to verify any changes you make to the certificate at a later date.

   · Retype Password
   Retype the password you entered for the challenge password.

5. Click the Generate Certificate Request button.
   After a short pause, the SSL Certificate Request screen opens.
6. Use the SSL Certificate Request screen, to start the process of obtaining a certificate from a CA, and then to generate and install a temporary certificate.
   
   

   · Begin the process for obtaining a certificate from CA
   Click on the URL of a CA to begin the process of obtaining a certificate for the server. After you select a CA, follow the directions on their web site to submit the certificate request. After your certificate request is approved, and you receive a certificate back from the CA, see To install certificates from the CA using the Configuration utility, on page 8-9, for information about installing it on the BIG-IP Controller.

   · Generate and install a temporary certificate
   Click the Generate Self-Signed Certificate button to create a self-signed certificate for the server. We recommend that you use the temporary certificate for testing only. You should take your site live only after you receive a properly-signed certificate from a certificate authority. When you click this button, a temporary certificate is created and installed on the
   BIG-IP Controller. This certificate is valid for 10 years. This temporary certificate allows you to set up an SSL gateway for the SSL Accelerator while you wait for a CA to return a permanent certificate.

Generating a key and obtaining a certificate from the command line

To obtain a valid certificate, you must have a private key. If you do not have a key, you can use the genconf and genkey utilities on the BIG-IP Controller to generate a key and a temporary certificate. The genkey and gencert utilities automatically generate a request file that you can submit to a certificate authority (CA). If you have a key, you can use the gencert utility to generate a temporary certificate and request file.

These utilities are described in the following list:

• genconf
  This utility creates a key configuration file that contains specific information about your organization. The genkey utility uses this information to generate a certificate.
• genkey
  After you run the genconf utility, run this utility to generate a temporary 30 day certificate for testing the SSL Accelerator on the BIG-IP Controller. This utility also creates a request file that you can submit to a certificate authority (CA) to obtain a certificate.
• gencert
  If you already have a key, run this utility to generate a temporary certificate and request file for the SSL Accelerator.

To generate a key configuration file using the genconf utility

If you do not have a key, you can generate a key and certificate with the genconf and genkey utilities. First, run the genconf utility from the root (/) with the following commands:

cd /

/usr/local/bin/genconf

The utility prompts you for information about the organization for which you are requesting certification. This information includes:

• The fully qualified domain name (FQDN) of the server
• The two-letter ISO code for your country
• The full name of your state or province
• The city or town name
• The name of your organization
• The division name or organizational unit
  
  

  For example, Figure 8.2 contains entries for the server my.server.net:

  Figure 8.2 Example entries for the genconf utility

   Common Name (full qualified domain name): my.server.net    
     Country Name (ISO 2 letter code): US    
     State or Province Name (full name): WASHINGTON    
     Locality Name (city, town, etc.): SEATTLE    
     Organization Name (company): MY COMPANY    
     Organizational Unit Name (division): WEB UNIT  

  To generate a key using the genkey utility

  After you run the genconf utility, you can generate a key with the genkey utility. Type the following command from the root (/) to run the genkey utility:

  cd /usr/local/bin/genkey <server_name>

  For the <service_name>, type the FQDN of the server to which the certificate applies. After the utility starts, it prompts you to verify the information created by the genconf utility. After you run this utility, a certificate request form is created in the following directory:

  /config/bigconfig/<fqdn>.req

  The <fqdn> is the fully qualified domain name of the server. Please contact your CA and follow their instructions for submitting this request form.

  In addition to creating a request form that you can submit to a certificate authority, this utility also generates a temporary certificate. The temporary certificate is located in:

  /config/bigconfig/ssl.crt/<fqdn>.crt

  The <fqdn> is the fully qualified domain name of the server.

  Note that you must copy the key and certificate to the other controller in a redundant system.

  This temporary certificate is good for ten years, but for an SSL proxy you should have a valid certificate from your CA.

  Warning: Be sure to keep your previous key if you are still undergoing certification. The certificate you receive is valid only with the key that originally generated the request.

  To generate a certificate with an existing key using the gencert utility

  To generate a temporary certificate and request file to submit to the certificate authority with the gencert utility, you must first copy an existing key for a server into the following directory on the BIG-IP Controller:

  /config/bigconfig/ssl.key/

  After you copy the key into this directory, type the following command at the command line:

  cd /

  /user/local/bin/gencert <server_name>

  For the <server_name>, type the FQDN of the server to which the certificate applies. After the utility starts, it prompts you for various information. After you run this utility, a certificate request form is created in the following directory:

  /config/bigconfig/ssl.crt/<fqdn>.req

  The <fqdn> is the fully qualified domain name of the server. Please contact your certificate authority (CA) and follow their instructions for submitting this request form.

  Installing certificates from the certificate authority (CA)

  After you obtain a valid x509 certificate from a certificate authority (CA) for the SSL Accelerator, you must copy it onto each BIG-IP Controller in the redundant configuration. You can configure the accelerator with certificates using the Configuration utility or from the command line.

  To install certificates from the CA using the Configuration utility

  1. In the navigation pane, click Proxies.
     The Proxies screen opens.
  2. On Proxies screen, click the Install SSL Certificate Request tab.
     The Install SSL Certificate screen opens.
  3. In the Certfile Name box, type the fully qualified domain name of the server with the file extension .crt. If you generated a temporary certificate when you submitted a request to the CA, you can select the name of the certificate from the drop down list. This allows you to overwrite the temporary certificate with the certificate from the CA.
  4. Paste the text of the certificate into the Install SSL Certificate window. Make sure you include the BEGIN CERTIFICATE line and the END CERTIFICATE line. For an example of a certificate, see Figure 8.3.
     
     
• Click the Write Certificate File button to install the certificate.

  Figure 8.3 An example of a certificate

   -----BEGIN CERTIFICATE-----    
     MIIB1DCCAX4CAQAwDQYJKoZIhvcNAQEEBQAwdTELMAkGA1UEBhMCVVMxCzAJBgNV    
     BAgTAldBMRAwDgYDVQQHEwdTZWF0dGxlMRQwEgYDVQQKEwtGNSBOZXR3b3JrczEc    
     MBoGA1UECxMTUHJvZHVjdCBEZXZlbG9wbWVudDETMBEGA1UEAxMKc2VydmVyLm5l    
     dDAeFw0wMDA0MTkxNjMxNTlaFw0wMDA1MTkxNjMxNTlaMHUxCzAJBgNVBAYTAlVT    
     MQswCQYDVQQIEwJXQTEQMA4GA1UEBxMHU2VhdHRsZTEUMBIGA1UEChMLRjUgTmV0    
     d29ya3MxHDAaBgNVBAsTE1Byb2R1Y3QgRGV2ZWxvcG1lbnQxEzARBgNVBAMTCnNl    
     cnZlci5uZXQwXDANBgkqhkiG9w0BAQEFAANLADBIAkEAsfCFXq3Jt+FevxUqBZ9T    
     Z7nHx9uaF5x9V5xMZYgekjc+LrF/yazhmq4PCxrws3gvJmgpTsh50YJrhJgfs2bE    
     gwIDAQABMA0GCSqGSIb3DQEBBAUAA0EAd1q6+u/aMaM2qdo7EjWx14TYQQGomYoq    
     eydlzb/3FOiJAynDXnGnSt+CVvyRXtvmG7V8xJamzkyEpZd4iLacLQ==    
     -----END CERTIFICATE-----  

  After the certificate is installed, you can continue with the next step in creating an SSL gateway for the server.

  To install certificates from the CA using the command line

  Copy the certificate into the following directory on each BIG-IP Controller in a redundant system:

  /config/bigconfig/ssl.crt/

  Note: The certificate you receive from the certificate authority (CA) should overwrite the temporary certificate generated by genkey or gencert.

  If you used the genkey or gencert utilities to generate the request file, a copy of the corresponding key should already be in the following directory on the BIG-IP Controller:

  /config/bigconfig/ssl.eky/

  Warning: In a redundant system, the keys and certificates must be in place on both controllers before you configure the SSL Accelerator. You must do this manually; the configuration synchronization utilities do not perform this function.

  Creating a pool for the HTTP servers

  After you configure the BIG-IP Controller with the certificates and keys, the next step is to create a pool containing the HTTP servers for which the SSL Accelerator handles connections.

  To create pools using the Configuration utility:

  1. In the navigation pane, click Pools.
     The Pools screen opens.
  2. Click the ADD button.
     The Add Pool screen opens.
  3. In the Add Pool screen, configure the pool attributes. For additional information about configuring a pool, click the Help button.
     
     

     Configuration note

     For this example, you would create an HTTP pool named http_pool that would contain the following members:
     <server1>
     <server2>
     <server3>

  To define the pools from the command line

  To define a pool from the command line, use the following syntax:

  b pool <pool_name> { member <member_definition> ... member <member_definition>}

  To create the pools http_pool and ssl_pool, from the command line, you would type the following commands:

  b pool http_pool { member 192.168.100.1:80 member 192.168.100.2:80 }

  b pool ssl_pool { member 192.168.100.2:443 member 192.168.100.3:443 }

  Creating an HTTP virtual server

  The next task in configuring the SSL Accelerator is to create a virtual server that references the HTTP pool.

  To create an HTTP virtual server using the Configuration utility

  1. In the navigation pane, click Virtual Severs.
     The Virtual Servers screen opens.
  2. Click the ADD button.
     The Add Virtual Server screen opens.
  3. In the Add Virtual Server screen configure the virtual server.
     For additional information about configuring a pool, click the Help button.
     
     

     Configuration note

     For this example, you would create a virtual server using the pool http_pool.

  To create an HTTP virtual server from the command line

  After you have defined a pool that contains the HTTP servers, use the following syntax to create a virtual server that references the pool:

  b virtual <virt ip>:<port> use pool <pool_name>

  For example, if you want to create a virtual server 20.1.1.1:80, that references a pool of HTTP servers named http_pool, you would type the following command:

  b virtual 20.1.1.1:80 use pool http_pool

  After you create the virtual server that references the pool of HTTP servers, you can create an SSL gateway. The following section describes how to create an SSL gateway.

  Creating an SSL gateway

  After you create the HTTP virtual server for which the SSL Accelerator handles connections, the next step is to create an SSL gateway. This section also contains information about managing an SSL gateway.

  To create an SSL gateway using the Configuration utility

  1. In the navigation pane, click Proxies.
     The Proxies screen opens.
  2. Click the ADD button.
     The Add Proxy screen opens.
  3. In the Add Proxy screen, configure the attributes you want to use with the proxy. For additional information about configuring a proxy, click the Help button.

  To create an SSL gateway from the command line

  Use the following command syntax to create an SSL gateway:

  b proxy <ip>:<port> [vlans add <vlan_list>] [<unit id>] target <server | virtual> <ip>:<port> ssl enable key <key> cert <cert>

  For example, you can create an SSL gateway from the command line that looks like this:

  b proxy 10.1.1.1:443 unit 1 target virtual 20.1.1.1:80 ssl enable key my.server.net.key cert my.server.net.crt }

  Note that when the configuration is written out in the bigip.conf file, the line ssl enable is automatically added. When the SSL gateway is written in the /config/bigip.conf file, it looks like the text in Figure 8.4.

  Figure 8.4 An example SSL gateway configuration

   proxy 10.1.1.1:https unit 1 {    
         netmask 255.255.255.0     
         broadcast 10.1.1.255     
         target virtual 20.1.1.1:80     
         ssl enable     
         key my.server.net.key    
         cert my.server.net.crt    
     }   

  Enabling, disabling, or deleting an SSL gateway

  After you have created an SSL gateway, you can enable it, disable it, or delete it using the Configuration utility or from the command line.

  To enable or disable an SSL gateway using the Configuration utility

  1. In the navigation pane, click Proxies.
     The Proxies screen opens.
  2. In the Proxies list, select the SSL gateway you want to enable or disable.
     The Proxy Properties screen opens.
  3. In the Proxy Properties screen, clear the Enable box to disable the proxy, or check the Enable box to enable the SSL gateway.
  4. Click the Apply button.

  To delete an SSL gateway using the Configuration utility

  1. In the navigation pane, click Proxies.
     The Proxies screen opens.
  2. In the Proxies list, select the SSL gateway you want to delete.
     The Proxy Properties screen opens.
  3. Click Delete.

  To enable, disable, or delete an SSL gateway from the command line

  You can enable, disable, or delete an SSL gateway with the following syntax:

  b proxy <ip>:<port> enable

  b proxy <ip>:<port> disable

  b proxy <ip>:<port> delete

  For example, if you want to enable the SSL gateway 209.100.19.22:443, type the following command:

  b proxy 209.100.19.22:443 enable

  If you want to disable the SSL gateway 209.100.19.22:443, type the following command:

  b proxy 209.100.19.22:443 disable

  If you want to delete the SSL gateway 209.100.19.22:443, type the following command:

  b proxy 209.100.19.22:443 delete

  Displaying the configuration for an SSL gateway from the command line

  You can view the configuration information for an SSL gateway from the command line by using the show keyword.

  To display configuration information for an SSL accelerator gateway from the command line

  Use the following syntax to view the configuration for the specified SSL gateway:

  b proxy <ip>:<port> show

  For example, if you want to view configuration information for the SSL gateway 209.100.19.22:80, type the following command:

  b proxy 209.100.19.22:443 show

  You can see sample output of this command in Figure 8.5.

  Figure 8.5 Output from the bigpipe proxy show command

   SSL PROXY +---> 11.12.1.200:443 -- Originating Address -- Enabled  Unit 1     
               |     Key File Name balvenie.scotch.net.key    
               |     Cert File Name balvenie.scotch.net.crt    
               +===> 11.12.1.100:80 -- Destination Address -- Server     
         
         
     SSL PROXY +---> 11.12.1.120:443 -- Originating Address -- Enabled  Unit 1     
               |     Key File Name balvenie.scotch.net.key    
               |     Cert File Name balvenie.scotch.net.crt    
                 +===> 11.12.1.111:80 -- Destination Address -- virtual   

  Introducing the SSL accelerator scalable configuration

  This section explains how to set up a scalable one-armed SSL accelerator configuration. This configuration is useful for any enterprise that handles a large amount of encrypted traffic.

  With this configuration, you can easily add e-Commerce Controllers to keep up with expanding SSL content or a growing array of SSL content servers without adding more BIG-IP Controllers.

  Figure 8.6 shows a the scalable configuration. The configuration includes a BIG-IP Controller, the e-Commerce Controllers Accelerator1, Accelerator2, Accelerator3, and Accelerator4, and the server array Server1, Server2, Server3, and Server4.

  The following sections refer to Figure 8.6 as an example of how you can set up such a configuration.

  Note: The IP addresses shown in the example configuration are fictitious. When implementing your configuration, choose IP addresses that are consistent with your network or networks.

  

  Figure 8.6 An SSL accelerator scalable configuration

  Creating the scalable SSL accelerator configuration

  To implement the scalable configuration, you must configure the BIG-IP Controller that load balances the servers and SSL accelerators, each SSL accelerator, and each node that handles connections from the SSL accelerator.

  First, complete the following tasks on the BIG-IP Controller that you want to use to load balance connections to the SSL accelerators:

  • Create two load balancing pools
    One pool load balances HTTP connections using the IP addresses of the web servers, the other pool load balances SSL connections to the SSL accelerators.
  • Create virtual servers
    Create virtual servers that reference the load balancing pools. Create one virtual server for the pool load balancing the SSL connections to the accelerators, and another virtual server for the pool that load balances the HTTP connections to the servers.
  • Enable service 80 and service 443
    Enable service 80 and service 443 on the controller.
  • Set the idle connection timer
    Set the idle connection timer for service 443.
    
    

    Next, complete the following tasks for the SSL accelerators:

  • Set up SSL gateways
    Set up an SSL gateway for each accelerator
  • Enable service 443
    Enable service 443 for encrypted traffic.

  Configuring the BIG-IP Controller that load balances the SSL accelerators

  To configure the BIG-IP Controller that load balances the SSL accelerators, complete the following tasks on the BIG-IP Controller. This section describes how to complete each task.

  • Create two load balancing pools. One pool load balances HTTP connections using the IP addresses of the web servers, the other pool load balances SSL connections from the SSL accelerators.
  • Create virtual servers that reference the load balancing pools.
  • Enable port 80 and port 443 on the controller.

  Creating load balancing pools

  To create the load balancing pools required for the SSL accelerator configuration described in Figure 8.6, you need to create two pools.

  • A load balancing pool for connections using the IP addresses of the content server nodes. For this example, the HTTP pool is named http_virtual. This pool contains the following members:
    Server1 (10.3.0.11)
    Server2 (10.3.0.12)
    Server3 (10.3.0.13)
    Server4 (10.3.0.14)
  • A load balancing pool for SSL gateways. For this example, the SSL accelerator is named ssl_gateways. This pool contains the following members:
    accelerator1 (10.1.0.111)
    accelerator2 (10.1.0.112)
    accelerator3 (10.1.0.113)
    accelerator4 (10.1.0.114)

  To create a pool using the Configuration utility

  1. In the navigation pane, click Pools.
     The Pools screen opens.
  2. Click the Add button.
     The Add Pool screen opens.
  3. In the Add Pool screen, configure the load balancing method, persistence attributes, and members for the pool. For additional information about creating a pool, click the Help button.
     
     

     Configuration notes

     · For this example, create an HTTP pool named http_virtual. This pool contains the following members:
     Server1 (10.3.0.11)
     Server2 (10.3.0.12)
     Server3 (10.3.0.13)
     Server4 (10.3.0.14)

     · For this example, you could create an SSL accelerator pool named ssl_gateways. This pool contains the following members:
     accelerator1 (10.1.0.111)
     accelerator2 (10.1.0.112)
     accelerator3 (10.1.0.113)
     accelerator4 (10.1.0.114)

  To define a pool from the command line

  To define a pool from the command line, use the following syntax:

  b pool <pool_name> { member <member_definition> ... member <member_definition>}

  For example, if you want to create the pool http_virtual and the pool ssl_gateways, you would type the following commands:

  b pool http_virtual { member 10.3.0.11:80 member 10.3.0.12:80 member 10.3.0.13:80 member 10.3.0.14:80 }

  b pool ssl_gateways { member 10.1.0.111:443 member 10.1.0.112:443 member 10.1.0.113:443 member 10.1.0.114:443 }

  Creating the virtual servers

  Create a virtual server that references the pool that is load balancing the SSL connections, and another virtual server that references the pool that load balances the HTTP connections through the SSL accelerators.

  To define a standard virtual server that references a pool using the Configuration utility

  1. In the navigation pane, click Virtual Servers.
  2. Click the Add button.
     The Add Virtual Server screen opens.
  3. Fill in the attributes for the virtual server. For additional information about this screen, click the Help button.
     
     

     Configuration notes

     · To create the configuration described in Figure 8.6, create a virtual server 192.168.200.30 on port 443 that references the pool of SSL accelerators.

     · To create the configuration described in Figure 8.6, create a virtual server 192.168.200.30 on port 80 that references the pool of content servers.

  To define a standard virtual server mapping from the command line

  To define a standard virtual server from the command line, use the following syntax:

  b virtual <virt_IP>:<port> use pool <pool_name>

  Note that you can use host names in place of IP addresses, and that you can use standard service names in place of port numbers.

  To create the virtual servers for the configuration in Figure 8.6, you would type the following commands:

  b virtual 192.168.200.30:443 use pool ssl_gateways

  b virtual 192.168.200.30:80 use pool http_virtual

  Enabling ports 80 and 443 on the BIG-IP Controller

  For security reasons, the BIG-IP Controller ports do not accept traffic until you enable them. In this configuration, the BIG-IP Controller accepts traffic on port 443 for SSL, and on port 80 for HTTP. For this configuration to work, you must enable port 80 and port 443.

  Use the following command to enable these ports:

  b service 80 443 tcp enable

  Setting the idle connection timer for port 443

  In this configuration, you should set the idle connection timer to clean up closed connections on port 443. You need to set an appropriate idle connection time-out value so that valid connections are not disconnected, and closed connections are cleaned up in a reasonable time.

  To set the idle connection time-out using the Configuration utility

  1. In the navigation pane, click Virtual Servers.
  2. In the Virtual Servers list, click the virtual server you configured for SSL connections.
     The Virtual Server Properties screen opens.
  3. Click the Virtual Ports tab.
     The Virtual Ports screen opens.
  4. In the Port box, click the port. For the example in this section, choose 443.
     The Global Virtual Port Properties screen opens.
  5. In the Idle connection timeout TCP (seconds) box, type a time-out value for TCP connections. The recommended time-out setting is 10 seconds.
  6. In the Idle connection timeout UDP (seconds) box, type a time-out value for TCP connections. The recommended time-out setting is 10 seconds.
  7. Click Apply.

  To set the idle connection time-out from the command line

  To set the idle connection time-outs, type the following commands:

  b service <port> timeout <seconds>

  The <seconds> value is the number of seconds a connection is allowed to remain idle before it is terminated. The <port> value is the port on the wildcard virtual server for which you are configuring out of path routing. The recommended value for the TCP and UDP connection timeouts is 10 seconds.

  Configuring the SSL accelerators

  The next step in the process is to configure the SSL accelerators. Complete the following tasks on each SSL accelerator:

  • Set up an SSL gateway for each e-Commerce Controller
  • Enable port 443
  • Set the idle connection timer for port 443

  Setting up an SSL gateway for each e-Commerce Controller

  The first task you must complete on the SSL accelerator it to set up an SSL gateway for each e-Commerce Controller with the HTTP virtual server as target server.

  To create an SSL gateway using the Configuration utility

  1. In the navigation pane, click Proxies.
     The Proxies screen opens.
  2. Click the Add button.
     The Add Proxy screen opens.
  3. In the Add Proxy screen, configure the attributes you want to use with the proxy. For additional information about configuring a Proxy, click the Help button.
     
     

     Configuration note

     For this example, create the following proxies on Accelerator1, Accelerator2, Accelerator3, and Accelerator4, respectively: 10.1.0.111:443, 10.1.0.112:443, 10.1.0.113:443, and 10.1.0.114:443.

  To create an SSL gateway from the command line

  Use the following command syntax to create an SSL gateway:

  b proxy <ip>:<port> [vlans add <vlan_list>] target server <ip>:<port> ssl enable key <key> cert <cert>

  For example, to create the SSL gateways accelerator1, accelerator2, accelerator3 and acceslerator4, you would use the following commands. Note that the target for each gateway is the HTTP virtual server 192.168.200.30:80.

  b proxy 10.1.0.111:443 target server 192.168.200.30:80 ssl enable key my.server.net.key cert my.server.net.crt

  b proxy 10.1.0.112:443 10.1.0.255 target server 192.168.200.30:80 ssl enable key my.server.net.key cert my.server.net.crt

  b proxy 10.1.0.113:443 target server 192.168.200.30:80 ssl enable key my.server.net.key cert my.server.net.crt

  b proxy 10.1.0.114:443 target server 192.168.200.30:80 ssl enable key my.server.net.key cert my.server.net.crt

  Enabling port 443

  For security reasons, the ports on the SSL accelerators do not accept traffic until you enable them. In this configuration, the SSL accelerator accepts traffic on port 443 for SSL. For this configuration to work, you must enable port 443. Use the following command to enable this port:

  b service 443 tcp enable

  Additional configuration options

  Whenever you configure a BIG-IP Controller, you have a number of options.

  • You have the option in all configurations to configure a redundant BIG-IP Controller for fail-over. Refer to Redundant Systems in the BIG-IP Reference Guide, Chapter 1, Configuring the BIG-IP Controller.
  • All configurations have health monitoring options. Refer to Health Monitors in the BIG-IP Reference Guide, Chapter 1, Configuring the BIG-IP Controller.
  • When you create a pool, there is an option to set up persistence and a choice of load balancing methods. Refer to Pools in the BIG-IP Reference Guide, Chapter 1, Configuring the BIG-IP Controller.