F5 Herculon SSL Orchestrator, Setup

Page: 32 / 58

• Use Normal if the rule may match TLS connections at TLS handshake time and possibly again,
more specifically, after Herculon SSL Orchestrator exposes the plaintext of the TLS connection
(so you can manage HTTPS on nonstandard ports, for example). Normal rules may also match
non-TLS traffic (so, for example, a single rule can handle both HTTPS and HTTP).
• Use No TLS if the rules match only non-TLS traffic.
• Use Pre Handshake to have the rules match before any TLS handshake. This means the rules can
allow a connection to bypass SSL inspection completely,without even trying to learn the real name
of the remote server. All Dynamic Domain Bypass (DDB) rules must have
Phase set to Pre
Handshake .
• Use TLS Handshake rules to have the rules match only at TLS handshake time: they will never
match non-TLS traffic, and they are not checked again after the plaintext of a TLS connection
becomes available.
5. From the Protocol list, select the protocol of the connection based on the port number or protocol
recognition.
6. In the Source area, select a Type and a Value .
This option specifies the name of the Service Chain you configured that you want to use for this
classifier rule. From the
Type list, select one of the following and then click Add .
• For IP Address , type the required IP address in the Value field.
• For Data Group , select the name of your data group from the Value list.
7. In the Destination setting, select a Mode , Type , and Value .
This option specifies the destination of the connection. The value of this field is based on the selection
you made for the mode.
• From the Mode list, select the mode you want to use for this classifier rule. The mode you choose
determines the value you will use for the destination. You can choose one of the modes for each
classifier rule:
• For Address , the Destination filter you configure consists of one or more IP subnet or host
addresses just like the Source filter.
• For Geolocation , the Destination you configure contains 2-letter country and 3-letter
continent codes against which the IP Geolocation of the destination server is compared. The
continent codes are:
CAF =Africa, CAN =Antarctica, CAS =Asia, CEU =Europe, CNA =North
America, COC =Oceania, CSA =South. The country codes are those of ISO 3166 alpha-2.
• For IPI (IP Inspection), the Destination you configure contains one or more IP Intelligence
categories against which the destination IP address's reputation is matched. You must replace
SPACE characters in names of IP Intelligence categories with underscores (_) before adding
them to
Destination .
• For Port , the Protocol value must be All . The Destination contains one or more TCP port
numbers or ranges like 5557-5559 (use 0 or * to match all) against which the destination port
number is matched. The main use of this mode is to control non-TLS traffic such as SSH.
• For URLF (URL Filtering), the Destination you configure is one or more URL Filtering
categories against which the URL categorization of the destination server is compared. You
must replace SPACE characters in names of URL Filtering categories with underscores (_)
before adding them to
Destination .
• For DDB (Dynamic Domain Bypass), the Destination you configure contains one or more
DNS domain names (unique or wildcard) against which the destination hostname indicated by
the client in TLS SNI is matched. This mode is special because it classifies traffic before the
Herculon SSL Orchestrator implementation attempts any TLS handshake with the remote
server (that is, in Match Phase Pre-handshake). You may use
DDB to whitelist and bypass
traffic to servers which cause TLS handshake problems or that require TLS mutual (client-
certificate/smart-card) authentication. For
DDB , the Service Chain value you select must be
Bypass or Reject .
Creating Services, Service Chains, and Classifier Rules
32