# Balance HTTPS traffic(without decryption)

**URL:** https://community.a10networks.com/t/balance-https-traffic-without-decryption/737
**Category:** ADC - Application Delivery
**Created:** [July 15, 2022, 6:34am UTC](https://community.a10networks.com/t/balance-https-traffic-without-decryption/737 "2022-07-15T06:34:46Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![vknyazhev](https://avatars.discourse-cdn.com/v4/letter/v/87869e/32.png) [@vknyazhev](https://community.a10networks.com/u/vknyazhev)
#### Post date: [July 15, 2022, 6:34am UTC](https://community.a10networks.com/t/balance-https-traffic-without-decryption/737/1 "2022-07-15T06:34:46Z")

</div>

```yaml
Hi all!
The task is to balance HTTPS traffic to 2 servers (TLS1 + TLS2), without decryption. How to configure the virtual server correctly in this case?

```

The TLS|SSL processing itself will continue on TLS1+TLS2, i.e. you only need to do balancing

```yaml
1.slb virtual-server VIP_HTTPS 192.168.195.2
  port 443 https
    source-nat pool tls_srcnat
    service-group TLS_HTTPS
OR
2.slb virtual-server VIP_HTTPS 192.168.195.2
  port 443 tcp
    source-nat pool tls_srcnat
    service-group TLS_HTTPS

```

Please help

 ![изображение.png](https://us1.discourse-cdn.com/flex002/uploads/a10_community/original/1X/ba3e74a5a2cd3c5fbf4e0a6d41746ff363c9c9e7.png)

---

<div class="post-metadata">

### Author: ![mmartinez\_a10networks.com](https://avatars.discourse-cdn.com/v4/letter/m/d07c76/32.png) [@mmartinez\_a10networks.com](https://community.a10networks.com/u/mmartinez_a10networks.com)
#### Post date: [July 15, 2022, 8:26am UTC](https://community.a10networks.com/t/balance-https-traffic-without-decryption/737/2 "2022-07-15T08:26:37Z")

</div>

Hi ,  
The easiest is to use your 2nd option with a tcp vPort :

`slb virtual-server VIP_HTTPS 192.168.195.2`

`port 443 tcp`

`source-nat pool tls_srcnat`

`service-group TLS_HTTPS`

By design SLB is done on a per TCP connection basis so you’ll still see load balancing happening and connection correctly spread across your servers/service without creating a mess from a user/client prospective, except with some web browsers which may be picky about handling multiple TCP connections to the same FQDN service without maintaining the same encryption level.  
So in this situation you may need to bind a SourceIP persistence template as well, to allow you setup to work.  
Best Regards