Applies To:
Show Versions
F5 SSL Orchestrator
- 16.0.1
Summary:
This release note documents the version 8.4 release of F5 SSL Orchestrator.
Contents:
- Platform support
- Guided Configuration browser support
- User documentation for this release
- Features in SSL Orchestrator 8.x
- Fixes
- Known issues
- Install and upgrade SSL Orchestrator
- Contacting F5
- Legal notices
Platform support
SSL Orchestrator standalone base license is supported on the following platforms:
If SSL Orchestrator is the standalone base license installed on your system, you can add the following modules:
- URLF Filtering (subscription)
- IPI (subscription)
- Network HSM
- Access Policy Manager (APM)
- Secure Web Gateway (SWG)
- Advanced Routing
F5 BIG-IP Local Traffic Manager (LTM) base license with SSL Orchestrator as an add-on is supported on any available iSeries, Bourne, and VIPRION platforms:
| Platform name |
|---|
| 2000, i2000 |
| 4000, i4000 |
| 5000, i5000 |
| 7000, i7000 |
| 10000, i10000 |
| 11000, i11000 |
| 12000 (Bourne) |
| i15000 |
| Chassis name: VPR-22XX, VPR-24XX, VPR-4480, VPR-4800 |
Guided Configuration browser support
The Guided Configuration acts as the template for SSL Orchestrator. This release supports the following browsers and versions for use with Guided Configuration for SSL Orchestrator:
- Microsoft Internet Explorer 11.x - Only 32-bit browsers are supported.
- Mozilla Firefox 55.x
- Google Chrome 61.x
User documentation for this release
For a comprehensive list of documentation that is relevant to this release, refer to the SSL Orchestrator Documentation page.
Features in SSL Orchestrator 8.x
F5 recommends you review the entire SSL Orchestrator release notes and setup guide prior to upgrading and configuring a deployment.
Guided Configuration for SSL Orchestrator
Guided configuration is meant to guide you through setting up a particular use case on the SSL Orchestrator system. Each template requests minimal input and provides contextual help to assist users during setup. The current version of the Guided Configuration is displayed on the landing page. When a later upgrade becomes available, you can use the available link next to the version number to download it from downloads.f5.com then upload and install Guided Configuration for SSL Orchestrator on BIG-IP. Prior to installing and upgrading to the latest version of SSL Orchestrator, ensure that you read the release notes and setup guide for any prerequisites, task details, or troubleshooting and recovery steps during installation or upgrade.
Support Datagroup in iApplx Security Policy
Enables users to use datagroup (internal/external) for Client/Server - port/IP/Geolocation in the SSL Orchestrator Guided Configuration Security Policy. This feature reduces the complexity of Security Policy configurations where multiple ports/Ips are added. In addition, it reduces the number of LTM/SSLO objects required.
SSL Orchestrator High Availability (HA) behavior improvements
A streamlined SSL Orchestrator upgrade procedure allows upgrade capabilities that do not break the HA pair.
Strict Update option (Protected/Unprotected Configurations) improvements
The SSL Orchestrator Protected/Unprotected Configurations improvements provide: the ability to view the configuration differences between created and out of band (OOB) modified changes; the ability to preview configuration changes before applying the changes to the system; the option to either overwrite configuration changes or accept the changes before deployment.
Modify network objects through iAppLX
This feature allows you to change network objects thru iApplx. Network objects created for SSL Orchestrator Services like IPs and VLANs can now be modified once created without needing to delete/recreate the service in order to change the network objects.
HA-Status monitoring and remediation dashboard
SSL Orchestrator upgrades, deployments, and synchronization can be painful if the HA pair is in a bad state. This feature provides status of your HA pair before the upgrade and a remediation button to help fix any issues to ensure you proceed with the HA upgrade when in a good state. This feature also prevents unwanted configuration changes or modifications to an existing SSL Orchestrator configuration, minimizing discrepancies between the two HA devices and their configuration.
SSL Orchestrator HA diagnostics and sync-repair tool
SSL Orchestrator HA diagnostics and sync-repair tool
The ha-sync script includes the diagnostic capability to identify potential issues and can print out all of the issues found with the HA setup. The ha-sync script can then perform a sync-up, which should fix those issues, and ensure that both devices are fully in sync (both in MCP and REST). See the F5 Guided Configuration for SSL Orchestrator: High Availability Diagnostics and Sync-Repair Tool guide for detailed information.
Guided Configuration for SSL Orchestrator TLS 1.3 support
TLS 1.3 support is provided in Guided Configuration for SSL Orchestrator for inbound cases, both clientssl and serverssl, for enhanced performance and security.
SSL Orchestrator Topologies
SSL Orchestrator configuration topologies define the type of traffic (transparent or explicit) and the direction of traffic flow (inbound or outbound) you wish to inspect. These deployment settings, which can be modified as needed without undeploying a configuration, are complimented by SSL management settings that assist you in defining inbound decryption and outbound decryption, setting your service types (such as HTTP, ICAP, Layer 2/Layer 3 inline, and receive-only/TAP services) and creating your service policies by defining per-request and per-session policy settings that can be managed through a virtual policy editor.
- Outbound transparent proxy
- Outbound explicit proxy
- Inbound reverse proxy
- Outbound layer 2
- Inbound layer 2
The Existing Application topology is an inbound topology that allows you to create services, service chains, and security policies and attach them to an existing reverse proxy BIG-IP application.
Licensing and Provisioning for SSL Orchestrator Access Integration
Updated SSL Orchestrator Setup Utility with resource provisioning capabilities for licensed and unlicensed modules.
Multi-Layered Security
In order to solve specific security challenges, security administrators are accustomed to manually chaining together multiple point products, creating a bare-bones “security chain” consisting of multiple services. A typical chain may include components like Data Leak Prevention (DLP) scanners, Web Application Firewalls (WAF), Intrusion Prevention and Detection Systems (IPS and IDS), Malware Analysis tools, Secure Web Gateways (SWG), and more. In this model, all user sessions are provided the same level of security, as this “daisy chain” of services is hard-wired.
Virtual Clustered Multiprocessing (vCMP)
SSL Orchestrator supports Virtual Clustered Multiprocessing (vCMP) to provision and manage multiple hosted instances of the BIG-IP software on a single hardware platform.
Classification Engine
Classification Engine provides a rich set of methods based on context to dynamically determine how best to optimize the flow through the security stack. Context can minimally come from the following:
- Source IP/subnet
- Destination IP/subnet
- IP intelligence category - Subscription
- IP geolocation
- Host and domain name
- URL filtering category - Subscription
- Destination port
- Protocol
Other classifiers with greater flexibility are also available in the SSL Orchestrator VPE and with iRules to optimize and evaluate additional information.
Deployment Modes
- Single device mode
- High availability (HA) active/standby mode
In addition, the system can detect and transparently handle an explicit proxy between SSL Orchestrator and the internet.
High Availability Status (HA-Status)
SSL Orchestrator’s High Availability status (HA-Status) screen provides detailed information on the status of your HA devices with detailed warning and error messages indicating issues with your system status, HA network status, and device groups and options on how to fix. From the SSL Orchestrator home screen, you may select the Ha-Status icon at the top right to open the High Availability screen.
SSL Orchestrator Dashboard
The SSL Orchestrator Dashboard provides you with various methods to review and analyze the status and trends of your SSL Orchestrator environment and systems. Each tile has customizable features based on reporting time ranges.
SSL Orchestrator Analytics
SSL Orchestrator analytics provide a customizable view into your SSL Orchestrator statistics, and enable you to flexibly choose the information you want to view based on specified ranges of time that you can select and adjust.
Statistics generated:
- Hit Count
- Client Bytes Out Per Second
- Duration
- Server Bytes In
- Server Bytes In Per Second
- Hit Count Per Second
- Server Bytes Out Per Second
- Client Bytes In
- Client Bytes In Per Second
- Client Bytes Out
- Server Bytes Out
Statistics are generated for the following dimensions:
- Client Cipher Names
- Client Cipher Versions
- Server Cipher Names
- Server Cipher Versions
- Virtual Servers
- Site IP Addresses
- Traffic Types
- Decryption Status
- Policy Actions
- Service Paths
- URL Categories
- Applications
- Application Families
- IP Reputation
- Destination Countries
L7 Application Protocol Settings
SSL Orchestrator supports L7 application protocol settings allowing you to select a protocol to listen for specific traffic (IMAP, SMTPS, POP3, FTP, HTTP) to be processed.
Fixes
| ID number | Description |
|---|---|
| 880469-2 | Previously, in SSL Orchestrator, when the L3 Explicit topology was created in version 5.3.7 and then upgraded to SSL Orchestrator version 7.1.x, the following error message was displayed in the restnoded log: warning: [SSLO] Error: Error applying access profile: Error: 01020036:3: The requested Access Profile (/Common/sslo_icap.app/sslo_icap_accessProfile) was not found. This issue is fixed, and now the system handles the error and no longer displays the error message. |
| 992425-1 | An outbound topology with a custom interception rule failed to deploy in mini-flow modification when -in_t iRule was added. Now, this issue is fixed, and you can now successfully add the -in_t iRule. |
| 1001929-2 | Previously, while creating a new L2 service, the desired IP offset value was not displayed, impacting the generation of internal IPv4 and IPv6 addresses. This issue is fixed, and now all the available offset values are displayed correctly. Workaround: Follow these steps to display the IP offset values:
|
| 1025845-1 | Previously, in Chrome and Firefox browsers, the right top panel of the SSL Orchestrator landing page did not completely display, and the user could not see the icons and labels. Now, this issue is fixed. |
| 1029901-2 | Previously, you could not delete dependent services or security policies if the policy has multiple parent configurations such as Service Chain and Topology. This issue is fixed, and now you can delete the service of security policy if it is assigned to multiple Service Chains. |
Known issues
| ID number | Description |
|---|---|
| 1038373 | In the security policy configuration page of SSL Orchestrator UI, editing a rule with the condition "ip subnet match" with a datagroup value does not show the correct input field. Workaround: Delete and re-create the rule. |
| 1040709 | When you unbind SSL from the Interception Rules and attempt to delete that configuration, you get an error message that the SSL is used in the topology. Conditions: The topology is outbound/explicit. Interception rules are updated via the Interception Rules mini workflow. Workaround: Go to Topology flow, unbind SSL from the Interception Rules step, and then deploy. Now you can use the delete button to delete this SSL from the SSL Configuration list. |
Install and upgrade SSL Orchestrator
If you are installing or upgrading to SSL Orchestrator 8.4, you must also install BIG-IP 16.0.1.1. Likewise, if you are installing BIG-IP 16.0.1.1 and you plan to use SSL Orchestrator, you must also install or upgrade to SSL Orchestrator 8.4.
If you did not previously install SSL Orchestrator 16.0.0-8.0 and you currently have a version of SSL Orchestrator prior to 5.0, or are installing SSL Orchestrator for the first time, refer to the complete installation and upgrade instructions for F5 SSL Orchestrator in the SSL Orchestrator: Setup version 16.0.0-8.0 guide.
To install the F5 SSL Orchestrator 8.4 and you do not have an existing SSL Orchestrator add-on license, or a previous version of SSL Orchestrator installed, download the image from downloads.f5.com. For complete step-by-step installation instructions, see the BIG-IP Systems: Upgrading Software guide.
To upgrade to the newest version of SSL Orchestrator from a previous version prior to 5.0, or you have an existing add-on license, follow the recommended upgrade steps found in the Setting up F5 Guided Configuration for SSL Orchestrator section in the SSL Orchestrator: Setup guide. This procedure walks you through the uninstallation and deletion of existing SSL Orchestrator applications and RPM before installing the new ISO image.
If you do not follow the recommended upgrade procedure, further manual steps are required to reset your environment and undeploy the previous version. See the F5 Guided Configuration for SSL Orchestrator: Upgrade Recovery guide based on the previous version of SSL Orchestrator you are upgrading from and your access to the BIG-IP Applications LX menu.
These upgrade steps are required since previously deployed SSL Orchestrator configurations cannot be rolled forward or imported into the new version of SSL Orchestrator. Following one of the recommended upgrade procedures will assist you in preparing your system for a clean installation.
Contacting F5
| North America | 1-888-882-7535 or (206) 272-6500 |
| Outside North America, Universal Toll-Free | +800 11 ASK 4 F5 or (800 11275 435) |
| Additional phone numbers | Regional Offices |
| Web | http://www.f5.com |
| support@f5.com |
How to Contact F5 Support or the Anti-Fraud SOC
- By phone in the U.S. (accessible 24x7): 888-88askf5 (888-882-7535).
- International contact numbers: http://www.f5.com/training-support/customer-support/contact/.
- The Support Coordinator can contact the SOC as needed.
You can manage service requests and other web-based support online at F5 My Support (registration required). To register email CSP@F5.com with your F5 hardware serial numbers and contact information.
You can contact the Anti-Fraud SOC as follows:
- By phone in the U.S. (accessible 24x7): 866-329-4253 (Option #3 for Anti-Fraud)
- International contact numbers: https://f5.com/products/platforms/silverline/f5-silverline-ddos-protection
Additional resources
You can find additional support resources and technical documentation through a variety of sources.
| F5 Support | Free self-service tools give you 24x7 access to a wealth of knowledge and technical support. Whether it is providing quick answers to questions, training your staff, or handling entire implementations from design to deployment, F5 services teams are ready to ensure that you get the most from your F5 technology. |
| AskF5 Knowledge Base | The storehouse for thousands of knowledgebase articles that help you manage your F5 products more effectively. Whether you want to browse periodically to research a solution, or you need the most recent news about your F5 products, AskF5 is your source. |
| BIG-IP iHealth Diagnostics and BIG-IP iHealth Viewer | BIG-IP iHealth Diagnostics identifies issues, including common configuration problems and known software issues. It also provides solutions and links to more information. With BIG-IP iHealth Viewer, you can see the status of your system at-a-glance, drill down for details, and view your network configuration. |
| F5 DevCentral | Collaborate and share innovations including code samples, new techniques, and other tips, with more than 300,000 F5 users worldwide. DevCentral is the place to ask questions, find solutions, learn to harness the power of F5’s powerful scripting language, iRules, and much more. |
| Communications Preference Center | Here, you can subscribe to a number of communications from F5. For information about the types of notifications F5 provides, see K9970: Subscribing to email notifications regarding F5 products. |
