T Techclick ← All lessons
F5 · LTM · Module 4 · Interactive lesson

F5 LTM Module 4 profiles, SNAT & SSL

Client SSL decrypts the user. Server SSL re-encrypts to the pool. Passthrough cannot cookie-persist. SNAT Automap exists to stop asymmetric returns.

22 min read · L2 primary · Quiz at end

After this page you can

Lessons · F5 LTM series · Module 4

F5 LTM recorded course · 7 modules

Same lab numbers on every page: client 198.51.100.50, VIP 192.0.2.100, Self IPs 192.0.2.10 / 10.20.20.10, members 10.20.20.101–103.

  1. Hub · Course map
  2. M1 · Fundamentals & admin
  3. M2 · Networking & traffic flow
  4. M3 · Virtual Servers & pools
  5. M4 · Profiles, SNAT, SSL ← you are here
  6. M5 · Monitors, iRules, policies
  7. M6 · High availability
  8. M7 · Troubleshooting

Next → M5 · Monitors, iRules, policies

Recorded course + workbooks: My Courses · syllabus F5 LTM / GTM / ASM

The Virtual Server matched. Now what?

Module 3 intercepts traffic. Module 4 decides how each side of the full proxy behaves: TCP, HTTP, SNAT, persistence, TLS. Ticket: “Cookie persistence does nothing.” The VS is FastL4 or SSL passthrough — BIG-IP never saw HTTP.

Hero · two TLS legs
Independent client TLS and server TLS tunnels
Client SSL = BIG-IP is the TLS server to the user. Server SSL = BIG-IP is the TLS client to the pool. Offload uses only the first.
Quick answer

Offload: Client SSL only, HTTP to the pool. Re-encrypt / bridge: Client SSL + Server SSL. Passthrough: no HTTP profile, no cookie persist, no HTTP iRules. SNAT Automap rewrites the server-side source to a Self IP so the return path cannot skip BIG-IP.

Full proxy = two stacks

Flow 1 · client side vs server side
ClientTCP + ClientSSLHTTPneeds decryptSNATreturn pathServerTCP + ServerSSL?

Profiles attach per side. tcp-wan-optimized toward clients, tcp-lan-optimized toward servers is the usual starting pair.

Say this out loud

An HTTP profile does not decrypt TLS. Client SSL must terminate first. Attaching Server SSL on an offload design will break the backend HTTP port.

SNAT and SSL — pick on purpose

SNATBackend seesWhen
No-SNATReal client IPServers default-gateway through BIG-IP (or policy route back)
AutomapSelf IP on egress VLANDefault when you cannot control server routing
SNAT PoolAddresses you listedNeed many ephemeral ports / dedicated NAT range
SSL modeProfilesHTTP / cookie persist
OffloadClient SSLYes — HTTP to pool
Re-encryptClient SSL + Server SSLYes — still decrypted on BIG-IP
Passthroughnone of thoseNo — TMM never sees HTTP

Deeper SSL lesson: Offload vs re-encrypt vs passthrough. Deeper SNAT: SNAT concept and issues. Persistence: cookie vs source address.

Journey · SNAT Automap
Client packet rewritten to a Self IP then forwarded to a server
Without SNAT, a server whose default gateway is the core switch replies past BIG-IP. The client TCP session on TMM never completes.

Runbook — HTTPS offload with Automap

Side A · profiles

  1. TCP pair

    Client side: tcp-wan-optimized. Server side: tcp-lan-optimized. Custom profiles inherit a parent — change one knob, not a clone of everything.

  2. HTTP profile

    Required for cookie persistence, X-Forwarded-For, HTTP iRules, redirects.

  3. Client SSL profile

    Local Traffic > Profiles > SSL > Client. Cert/key for the VIP hostname. SNI if multiple certs on one IP.

https://192.168.100.10/tmui/Control/jspmap/tmui/locallb/profile/clientssl/create
Training mock · not live

Local Traffic > Profiles > SSL > Client > Create

New Client SSL Profile

clientssl_www
clientssl
www.example.com.crt / .key
Auto Map

Never export private keys casually. UCS files contain keys — treat backups as secret.

Side B · Virtual Server attachments

https://192.168.100.10/tmui/Control/jspmap/tmui/locallb/virtual_server/create
Training mock · not live

Local Traffic > Virtual Servers > vs_web_https

HTTPS Virtual Server resources

http
clientssl_www
None — this is offload
Auto Map
cookie (needs HTTP + Client SSL)

If you need TLS to the pool, add a Server SSL profile (bridge). Do not add it 'just in case'.

Side C · persistence + proof

MethodNeedsWeakness
CookieHTTP + (usually) Client SSLFails on passthrough / FastL4
Source addressL4 is enoughNAT/CGNAT makes a whole office one persistence record
SSL sessionClient SSLNot a substitute for HTTP cookie on apps that need URI affinity
Proof
curl -vk https://www.example.com/ --resolve www.example.com:443:192.0.2.100
tmsh show ltm profile client-ssl clientssl_www
tmsh show ltm persistence persist-records
# offload: server-side capture is HTTP, not TLS
Ops · TLS handshake
Padlock and handshake checkmarks on an operations monitor
Handshake fail = cert name, SNI, or cipher — not 'pool down' until tcpdump says so.

Runtime

Flow 2 · offload packet
TLS inClient SSLHTTPprofile + persistSNATSelf IPHTTP outpool member

OneConnect reuses server-side TCP. Do not enable it on apps that assume one client per server connection (legacy NTLM without the NTLM profile).

Traps + proof

FailureSymptomFix
Server SSL on offloadBackend HTTP port gets TLSRemove Server SSL
Cookie persist + passthroughUser bounces serversTerminate TLS or use source-addr
No-SNAT, wrong gwSYN out, no SYN-ACKAutomap or fix server gateway
F5 browser refresh as LB testAlways one memberNew TCP each time
UCS emailedPrivate keys leakedOff-box backup with access control
You are done with Module 4 when

Knowledge check

SSL and SNAT judgment — these are interview gold.

Q1

SSL offload requires:

Correct: b. Do not attach Server SSL 'just in case'.
Q2

Cookie persistence on passthrough:

Correct: b. Need terminate or use source-addr.
Q3

Servers default-gateway past BIG-IP. You likely need:

Correct: b. Force return to the Self IP.
Q4

HTTP profile without Client SSL on :443:

Correct: b. Terminate first.
Q5

Source-address persistence behind CGNAT is weak because:

Correct: b. Use cookie when you can see HTTP.
Q6

Valid offload proof includes:

Correct: b. Traps table.

Sources

Related: Course hub · Syllabus · My Courses · F5 LTM interview