配置SSL动作转发客户流量
注解:版本12.1构建49x
客户 hello消息中,如果你接收到ADC不支持的密码,你可以配置SSL动作向不同的虚拟服务器传输客户流量如果您不想卸载SSL,配置TCP或SSL_BRIDGE虚拟服务器ADC上没有SSL卸载并绕过流量SSL卸载时,配置SSL虚拟服务器为前向虚拟服务器
执行下列步骤:
- 添加负载平衡型SSL虚拟服务器客户端流量接收虚拟服务器
- 绑定 ssl服务到虚拟服务器
- 添加负载平衡虚拟服务器类型TCP注解IP地址或端口号不强制传输虚拟服务器
- 添加TCP服务端口443
- 将此项服务绑定前创建的TCP虚拟服务器
- 添加 ssl动作定义TCP虚拟服务器
- 添加SSL策略具体说明以上动作
- 将策略绑入SSL虚拟服务器
- 保存配置
配置使用CLI
sl/server_rsa_2048.pm-key/server/server/server+lbvserver+2TCPservice
sh ssl vserver v1 Advanced SSL configuration for VServer v1: DH: DISABLED DH Private-Key Exponent Size Limit: DISABLED Ephemeral RSA: ENABLED Refresh Count: 0 Session Reuse: ENABLED Timeout: 120 seconds Cipher Redirect: DISABLED SSLv2 Redirect: DISABLED ClearText Port: 0 Client Auth: DISABLED SSL Redirect: DISABLED Non FIPS Ciphers: DISABLED SNI: ENABLED OCSP Stapling: DISABLED HSTS: DISABLED HSTS IncludeSubDomains: NO HSTS Max-Age: 0 SSLv2: DISABLED SSLv3: ENABLED TLSv1.0: ENABLED TLSv1.1: ENABLED TLSv1.2: ENABLED TLSv1.3: DISABLED Push Encryption Trigger: Always Send Close-Notify: YES Strict Sig-Digest Check: DISABLED Zero RTT Early Data: DISABLED DHE Key Exchange With PSK: NO Tickets Per Authentication Context: 1 ECC Curve: P_256, P_384, P_224, P_521 1) CertKey Name: sv Server Certificate Data policy 1) Policy Name: pol2 Priority: 1 1) Cipher Name: DEFAULT Description: Default cipher list with encryption strength >= 128bit Done sh ssl policy pol2 Name: pol2 Rule: client.ssl.client_hello.ciphers.has_hexcode(0x002f) Action: act1 UndefAction: Use Global Hits: 0 Undef Hits: 0 Policy is bound to following entities 1) Bound to: CLIENTHELLO_REQ VSERVER v1 Priority: 1 Done
sl动作动作1 1)名:active1类型:数据插入前向:v2点击:0undef点击:0Active引用计数:1
sh ssl vserver v2 Advanced SSL configuration for VServer v2: DH: DISABLED DH Private-Key Exponent Size Limit: DISABLED Ephemeral RSA: ENABLED Refresh Count: 0 Session Reuse: ENABLED Timeout: 120 seconds Cipher Redirect: DISABLED SSLv2 Redirect: DISABLED ClearText Port: 0 Client Auth: DISABLED SSL Redirect: DISABLED Non FIPS Ciphers: DISABLED SNI: DISABLED OCSP Stapling: DISABLED HSTS: DISABLED HSTS IncludeSubDomains: NO HSTS Max-Age: 0 SSLv2: DISABLED SSLv3: ENABLED TLSv1.0: ENABLED TLSv1.1: ENABLED TLSv1.2: ENABLED TLSv1.3: DISABLED Push Encryption Trigger: Always Send Close-Notify: YES Strict Sig-Digest Check: DISABLED Zero RTT Early Data: DISABLED DHE Key Exchange With PSK: NO Tickets Per Authentication Context: 1 ECC Curve: P_256, P_384, P_224, P_521 1) CertKey Name: sv Server Certificate 1) Cipher Name: DEFAULT Description: Default cipher list with encryption strength >= 128bit
GUI配置
创建TCP虚拟服务器:
- 导航至流量管理>加载平衡>虚拟服务器.
- 创建TCP虚拟服务器
- 点击中服务组段并添加tCP服务或绑定现有服务
- 点击绑定.
- 点击继续.
创建SSL虚拟服务器:
- 导航至流量管理>加载平衡>虚拟服务器.
- 创建另一个SSL虚拟服务器
- 点击中服务组并添加新SSL服务或绑定现有服务
- 点击绑定.
- 点击继续.
- 点击中证书认证并绑定服务器证书
- 点击继续.
- 内高级设置中键SSL策略.
- 点击中SSL策略段添加或选择现有策略
- 内策略绑定中键添加并指定策略名称
- 内动作中键添加.
- 指定SSL动作名称内前向动作虚拟服务器选择前置TCP虚拟服务器
- 点击创建.
- 定义性Client.SSL.Client_HELLO.CIPHERS.HAS_HEXCODE表达式中
- 点击成交.
- 策略中配置表达式评价非支持密码流
- 绑定动作策略和SSL虚拟服务器策略指定绑定点Clienllo_req.
- 点击成交.
收到
失败