Manual Chapter :
Encrypting Application Traffic with iSession
Applies To:
Show Versions
BIG-IP AAM
- 14.1.3, 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0
BIG-IP APM
- 14.1.3, 14.1.2, 14.0.1, 14.0.0, 13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0, 13.0.1, 13.0.0
Overview: Encrypting application traffic with iSession
You can use either SSL or IPsec to encrypt application data traffic through a secured iSession™ connection, depending on how you configure symmetric optimization.
- If you are using IPsec, you specify IPsec encapsulation of the data traffic. After the trust relationship is established between the iSession endpoints, the data traffic is encapsulated, regardless of the application.
- If you are using SSL, you specify WAN encryption on a per-application basis when you create an iApps® template for that application. If you manually create an optimized application virtual server for outbound iSession traffic, ensure that you associate an iSession profile that has encryption enabled.
Note: Selecting IPsec encapsulation supersedes any per-application SSL data
encryption settings.
Task summary for encrypting application traffic using IPsec
Before you begin encrypting application traffic, you must secure the iSession™ endpoints using SSL.
After the iSession connection is secure, the easiest and quickest method of configuring application data encryption using IPsec is on the Quick Start screen.
Note: For this implementation, creating a custom policy is an optional task.
Task list
Encrypting application traffic using IPsec on the Quick Start screen
You cannot view the Quick Start screen until you have defined at least one VLAN and
at least one self IP on a configured BIG-IP® system that is
provisioned for acceleration.
You complete this task to encrypt application traffic over an iSession connection
using IPsec.
-
In the IP Encapsulation area, select IPsec from the
IP Encapsulation Type list.
The screen refreshes and displays the IPSEC Policy field.
Application traffic is now encrypted over the iSession connection using IPsec,
according to the settings in the selected IPsec policy.
Creating a custom IPsec policy for iSession traffic
You can create a custom IPsec policy for iSession traffic if you want settings
that are different from the default values. For example, you might want to specify a
different authentication algorithm or Diffie-Hellman group for IKE phase 2
negotiations.
For a custom IPsec policy to take effect, you must apply it to the iSession
endpoints. You can select it on the Quick Start screen or the Local Endpoint screen.
The selected policy settings must be the same on both endpoints of an iSession
connection.
