SSL bypass decision based on group membership and URL category

(For this example to be valid, both the server and client SSL profiles on the virtual server must enable SSL forward proxy and SSL forward proxy bypass; the client SSL profile must set the default bypass action to Intercept.)

1. On the Main tab, click Access > Profiles / Policies > Per-Request Policies .
   The Per-Request Policies screen opens.
2. Click Create.
   The General Properties screen displays.
3. In the Name field, type a name for the policy and click Finished.
   A per-request policy name must be unique among all per-request policy and access profile names.
   The policy name appears on the Per-Request Policies screen.

1. On the Main tab, click Access > Profiles / Policies > Per-Request Policies .
   The Per-Request Policies screen opens.
2. In the Name field, locate the policy that you want to update, then in the Per-Request Policy field, click the Edit link.
   The visual policy editor opens in another tab.
3. To process the HTTPS traffic first, configure a branch for it by adding a Protocol Lookup item at the start of the per-request policy.
   1. Click the (+) icon anywhere in the per-request policy to add a new item.
      A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
   2. In the Search field, type prot, select Protocol Lookup, and click Add Item.
      A properties popup screen opens.
   3. Click Save.
      The properties screen closes. The policy displays.
   The Protocol Lookup item provides two default branches: HTTPS for SSL traffic and fallback.
4. Before you add an SSL Bypass Set, or an SSL Intercept Set, item to the per-request policy, you can insert any of the following policy items to do logging or to base how you process the SSL traffic on group membership, class attribute, day of the week, time of day, or URL category:
   • AD Group Lookup
   • LDAP Group Lookup
   • LocalDB Group Lookup
   • RADIUS Class Lookup
   • Dynamic Date Time
   • Logging
   • Category Lookup
     Important: Category Lookup is valid for processing SSL traffic only when configured for SNI or Subject.CN categorization input and only before any HTTP traffic is processed.
   If you insert other policy items that inspect the SSL payload (HTTP data) before an SSL Bypass Set item, the SSL bypass cannot work as expected.
5. At any point on the HTTPS branch where you decide to bypass SSL traffic, add an SSL Bypass Set item.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the name of the virtual server.
3. In the Access Policy area, from the Per-Request Policy list, select the policy that you configured earlier.
4. Click Update.

F5 recommends multiple virtual servers for configurations where Access Policy Manager^® (APM^®) acts as an explicit or transparent forward proxy. This table lists forward proxy configurations, the virtual servers recommended for each, and whether an access profile and per-request policy should be specified on the virtual server.

For SSL bypass or SSL intercept actions, Access Policy Manager^® (APM^®) forwards the client hello directly to the server. The client and server then negotiate SSL parameters. This must occur before any per-request policy item inspects the SSL payload (HTTP data). Everything that the policy does before an SSL Bypass Set or SSL Intercept Set policy item must operate either on SSL data (certificate or client hello) or on session data (which is not part of SSL payload).

To ensure that SSL Bypass Set and SSL Intercept Set work correctly, do not place them in a per-request policy after any of these items:

• Application Lookup
• Application Filter Assign
• Category Lookup, if configured to use HTTP URI for input
• HTTP Headers
• Proxy Select
• Select SSO Configuration
• URL Filter Assign