AVI Layer 7 HTTPS mode and configuration

AVI Layer 7 Https

AVI supports three modes for Layer 7 Https LB:

• HTTPS Off-Load
• HTTPS End-to-End SSL
• SSL Passthrough

HTTPS Off-Load

In this mode, the traffic will be fully encrypted between the user terminal and the SE, the entire encryption process is only once, and the performance will be better. This mode is also officially recommended, and it balances security, SE flexibility, and performance.
Insert picture description here
The above figure shows the process of establishing a connection. The L7 Https load balancing connection is established after the client TCP handshake + SSL Handshake + HTTP request. SE uses Http (plain text) to forward the user's connection request.

Configuration

First, upload a Server Certificate or create a Self-Signed Certificate to
Insert picture description here

configure Virtual Service.

Select Advanced Setup and

select the red part according to system parameters.

Note ssl enable and pool selection/creation.

Create a pool. Note that the service port here is the backend service port.

Others are default, SAVE

HTTPS End-to-End SSL

In this mode, the traffic will be encrypted end-to-end between the user terminal and the application. The entire encryption process is performed twice for the best security.
Insert picture description here
The above figure shows the process of establishing a connection. The Https load balancing connection of L7 is established after the client TCP handshake + SSL Handshake + HTTP, and the SE uses Https (ciphertext) to forward the user's connection requirements.

Configuration

Insert picture description here

Note that the port here is 443, and
the configuration of the SSL profile pool of the system should be https

other default, SAVE

SSL Passthrough

The SSL Passthrough mode occurs when the SSL connection does not require encryption, and the SSL connection is directly connected from the client to the server in the pool.
Insert picture description here
In actual use, when Web application security is the most important issue, SSLPassthrough mode will be used.
That is, if the system layer 4 application of the created HTTPS VS is assigned as the layer 7 HTTP profile, the SSL traffic will be treated as a pass-through (layer 4) and flow through the NSX ALB without terminating the encrypted traffic.