SWG as an SSLO service

With BIG-IP 16.1 and SSLO 9.0, we now offer SWG within the SSLO interface, specifically in the F5 tab as part of the Solutions Catalog. This update does not change any of the previous APM + SWG behavior but provides a more user-friendly configuration and management experience when included with SSL Orchestrator, which is the most common forward proxy use case.

Abort support in blocked TLS session

The SSL Orchestrator security policy now contains a new abort option as a blocking action.

Bypass TLS decryption based on SNI

You can now configure a security policy to bypass TLS decryption based on SNI received in ClientHello before any server-side evaluation. A TLS bypass can now be created successfully by SNI/hostname for mutual TLS authentication without breaking the connection.

authorityKeyIdentifier extension support for certificates

SSL Orchestrator now includes an authorityKeyIdentifier (AKI) in the forged server certificate to aid in certificate path discovery at the client. Path discovery is the mechanism that a TLS client performs to find and build a complete chain of trust from the end-entity (leaf) certificate to the explicitly trusted root CA.

SSL profile switching based on ClientHello SNI matches

Allowing an outbound topology to switch its SSL profile based on SNI matches is useful when switching a CA issuer for different tenants or bypassing TLS for mutual TLS sessions by SNI hostname. For BIG-IP 16.1.0, only traffic processing in the data plane is currently supported.

Local OCSP Responder support

In Guided Configuration, you can now configure a local Online Certificate Status Protocol (OCSP) Responder and associate a Local OCSP Responder to a virtual server (that is part of the TMUI). OCSP is an Internet protocol used to obtain the revocation status of a digital certificate. When the validity of a certificate is requested, an OCSP request is sent to an OCSP Responder and checks the specific certificate with a trusted certificate authority. This results in an OCSP response being sent back of good, revoked, or unknown.

Send SSL session logs using log publisher

SSL Orchestrator can now log details of the forged server certificate and pass it to external log consumers using log publisher. TMM generates SSL session logs when the STIP (CC) mode is enabled.

Full-proxy HTTP/2 support through the decrypted service chain

SSL Orchestrator now supports full-proxy HTTP/2 through the decrypted service chain. In this feature, since HTTP/2 is not currently de-multiplexed, the security services must support decrypted HTTP/2.

Verified Accept support in SSLO

SSL Orchestrator now supports Verified Accept in TCP for L2 inbound/outbound topologies. This feature, when enabled, allows the system to test for a valid server-side connection before completing the client-side handshake. The system sends the server a SYN cookie before responding to the client’s SYN and verifies that the pool member is available to accept the connection.

Secure Web Gateway service

Secure Web Gateway can now be configured as part of the SSLO service chain.

Define DNS settings per topology

SSL Orchestrator now allows explicit proxy topologies to define specific DNS resolver settings.

Standalone license permits 20 pool members

SSL Orchestrator standalone license has always limited the number of service pool members to 6 devices. This licensing update now increases that number to 20 pool members.

Proxy TCP Keepalive in SSLO

A new iRule command, TCP::keepalive, allows TCP keep-alive proxy settings to be enabled dynamically. With this feature, the SSL Orchestrator interception rule can now decide based on criteria such as client IP, destination port, or other attributes to enable TCP keep-alive on a connection selectively. This is useful when a client (for example, Citrix Workspace client) requires a keep-alive to stay connected to the upstream server.

SSO Control Plane re-architecture

SSL Orchestrator 9.0 includes the following significant improvements to the control plane:

• The source-of-truth for the SSL Orchestrator configuration is now stored in the iFile objects. This allows the SSL Orchestrator to utilize native MCP/CMI HA sync functions and support automatic and incremental sync.
• The iApp strictness lock icon has been removed from several objects, excluding network and access objects allowing you to make out-of-band changes freely.
• The SSLO architecture now no longer uses the Gossip sync function to sync SSLO REST configuration.

Tabbed interface for service catalog

The security products in the SSL Orchestrator service catalog are now represented in a new de-cluttered tabbed interface, with Inline L2, Inline L3, Inline HTTP, ICAP, TAP, and a new F5 tab. The F5 tab currently includes just one service; Secure Web Gateway.

Guided Configuration for SSL Orchestrator

Guided configuration is meant to guide you through setting up a particular use case on the SSL Orchestrator system. Each template requests minimal input and provides contextual help to assist users during setup. The current version of the Guided Configuration is displayed on the landing page. When a later upgrade becomes available, you can use the available link next to the version number to download it from downloads.f5.com then upload and install Guided Configuration for SSL Orchestrator on BIG-IP. Before installing and upgrading to the latest version of SSL Orchestrator, ensure that you read the release notes and setup guide for any prerequisites, task details, or troubleshooting and recovery steps during installation or upgrade.

Guided Configuration for SSL Orchestrator TLS 1.3 support

TLS 1.3 support is provided in Guided Configuration for SSL Orchestrator for inbound cases, both clientssl and serverssl, for enhanced performance and security.

SSL Orchestrator Topologies

SSL Orchestrator configuration topologies define the type of traffic (transparent or explicit) and the direction of traffic flow (inbound or outbound) you wish to inspect. These deployment settings, which can be modified as needed without undeploying a configuration, are complimented by SSL management settings that assist you in defining inbound decryption and outbound decryption, setting your service types (such as HTTP, ICAP, Layer 2/Layer 3 inline, and receive-only/TAP services) and creating your service policies by defining per-request and per-session policy settings that can be managed through a virtual policy editor.

• Outbound transparent proxy
• Outbound explicit proxy
• Inbound reverse proxy
• Outbound layer 2
• Inbound layer 2

The Existing Application topology is an inbound topology that allows you to create services, service chains, and security policies and attach them to an existing reverse proxy BIG-IP application.

Licensing and Provisioning for SSL Orchestrator Access Integration

Updated SSL Orchestrator Setup Utility with resource provisioning capabilities for licensed and unlicensed modules.

Multi-Layered Security

In order to solve specific security challenges, security administrators are accustomed to manually chaining together multiple point products, creating a bare-bones “security chain” consisting of multiple services. A typical chain may include components like Data Leak Prevention (DLP) scanners, Web Application Firewalls (WAF), Intrusion Prevention and Detection Systems (IPS and IDS), Malware Analysis tools, Secure Web Gateways (SWG), and more. In this model, all user sessions are provided the same level of security, as this “daisy chain” of services is hard-wired.

Virtual Clustered Multiprocessing (vCMP)

SSL Orchestrator supports Virtual Clustered Multiprocessing (vCMP) to provision and manage multiple hosted instances of the BIG-IP software on a single hardware platform.

Classification Engine

Classification Engine provides a rich set of methods based on context to dynamically determine how best to optimize the flow through the security stack. Context can minimally come from the following:

• Source IP/subnet
• Destination IP/subnet
• IP intelligence category - Subscription
• IP geolocation
• Host and domain name
• URL filtering category - Subscription
• Destination port
• Protocol

Other classifiers with greater flexibility are also available in the SSL Orchestrator VPE and with iRules to optimize and evaluate additional information.

Deployment Modes

In addition, the system can detect and transparently handle an explicit proxy between SSL Orchestrator and the internet.

SSL Orchestrator Analytics

SSL Orchestrator analytics provide a customizable view into your SSL Orchestrator statistics, and enable you to flexibly choose the information you want to view based on specified ranges of time that you can select and adjust.

Statistics generated:

• Hit Count
• Client Bytes Out Per Second
• Duration
• Server Bytes In
• Server Bytes In Per Second
• Hit Count Per Second
• Server Bytes Out Per Second
• Client Bytes In
• Client Bytes In Per Second
• Client Bytes Out
• Server Bytes Out

Statistics are generated for the following dimensions:

• Client Cipher Names
• Client Cipher Versions
• Server Cipher Names
• Server Cipher Versions
• Virtual Servers
• Site IP Addresses
• Traffic Types
• Decryption Status
• Policy Actions
• Service Paths
• URL Categories
• Applications
• Application Families
• IP Reputation
• Destination Countries

L7 Application Protocol Settings

SSL Orchestrator supports L7 application protocol settings allowing you to select a protocol to listen for specific traffic (IMAP, SMTPS, POP3, FTP, HTTP) to be processed.

How to Contact F5 Support or the Anti-Fraud SOC

You can manage service requests and other web-based support online at F5 My Support (registration required). To register email CSP@F5.com with your F5 hardware serial numbers and contact information.

You can contact the Anti-Fraud SOC as follows:

• By phone in the U.S. (accessible 24x7): 866-329-4253 (Option #3 for Anti-Fraud)
• International contact numbers: https://f5.com/products/platforms/silverline/f5-silverline-ddos-protection

Additional resources

You can find additional support resources and technical documentation through a variety of sources.