SSL Passthrough

Product Discussions ADC - Application Delivery
1

Hi Friends,
How to configure ssl passthrough on a10 vthunder?
what are the configuration required to do

2

Configure you Virtual Server

virtual-server SSL-Passthrough-VS
 virtual-port 443
 protocol tcp
 no ssl-proxy

then configure Service Group

service-group SSL-Passthrough-SG
 member <backend-server-1> port 443
 member <backend-server-2> port 443
 ssl-certificate <path-to-certificate-file>

Configure Health Monitor

health-monitor TCP-443
 interval 10
 timeout 5
 rise-count 2
 fall-count 3
 reattempt 3
 port 443
 protocol tcp

Enable SSL Passthrough

slb virtual-server SSL-Passthrough-VS
 ssl-passthrough enable

Verify that traffic is being forwarded correctly to the backend servers by testing SSL connections to the virtual server.

3

The above syntax does not appear to be correct for ACOS. What version is this for?
If no layer 7 traffic inspection is required, we can accomplish this by configuring layer 4 virtual port (ex. port 443 tcp) which will pass all SSL through the A10 to the backend server.
If we need layer 7 inspection but require SSL encryption between A10 and backend server, we can configure layer 7 virtual port (ex. port 443 https) and bind both client-ssl and server-ssl templates.

4

You are correct; the previous configuration was not specific to ACOS on A10 vThunder. Here’s the correct approach for SSL passthrough on ACOS:
If you don’t need Layer 7 traffic inspection and want to pass SSL traffic directly to the backend server without SSL decryption, you can configure a Layer 4 virtual port 443.
This will allow all SSL traffic to pass through the A10 vThunder to the backend server.
Exa:
virtual-server SSL-Passthrough-VS
 virtual-port 443
 protocol tcp
 server 443
 server 443

If you require Layer 7 traffic inspection but still want SSL encryption between the A10 vThunder and the backend server,
you can configure a Layer 7 virtual port 443 and bind both client-ssl and server-ssl templates.
ex:
ssl client-template CLIENT-SSL
 key
 cert

ssl server-template SERVER-SSL
 key
 cert

virtual-server Layer7-VS
 virtual-port 443
 protocol https
 server 443
 server 443
 template client CLIENT-SSL
 template server SERVER-SSL

Try this, I hope it helps.