Nokron
WAF F5
NokronGitLabELK stackWAF F5
WAF F5
NokronGitLabELK stackWAF F5
  • BIG-IP Application Security Manager
    • HTTP Protocol
      • Deep Dive to “HTTP Request” on ASM Module
      • ASM Example: Detecting a Malicious HTTP Request
    • Introduction to OWASP Top-10 Security Risks
    • Application Security Policy Templates in F5 ASM
      • Security Policy Levels
      • Explicit Entities Learning
      • Policy Modification
      • Gradual / Modular Blocking
      • Application Security Policy Lifecycle
      • Security Policy Enforcement Modes
      • Security Policy Violation Flags
      • How to Increase Learning Score / Deployment Speed
      • Comparison: Enforcement Mode, Learning Mode, and Violation Flags
    • Security Entities in Application Security Policy
      • Enforcement Readiness Summary
      • HTTP / HTTPS / WS / WSS URLs
      • Allowed Parameters in Security Policies
      • Allowed File Types in Security Policies
    • Tuning Security Policies: Analyzing and Categorizing Violations
      • Learning Suggestions in Security Policy Tuning
      • Policy Diff: Comparing and Auditing Security Policies
    • IP Address Exception Properties in ASM/AWAF
    • Cross-Site Request Forgery (CSRF) Protection in F5 ASM/AWAF
    • Sensitive Data Masking / Scrubbing (Data Guard) in F5 ASM/AWAF
    • Anti-virus Protection through an ICAP Server in F5 ASM/AWAF
    • Cookies in F5 ASM/AWAF Security
    • Session Tracking and Session Awareness in F5 ASM/AWAF
    • Evasion Technique Detection in F5 ASM/AWAF
    • Important Tips about Security Policy in F5 ASM/AWAF
    • L7 DDoS Attack Protection Configuration
    • TPS-based Attack Vectors and Stress-based Attack Vectors
    • Mitigation Techniques for DoS and Bot Protection
    • Important Tips about Events Logging
    • High-Speed Logging (HSL) Configuration
    • Web Threat Campaigns (v14.0+)
    • IP Intelligence (IPI) Subscription-Based License
    • Geo-IP Database Functionality
    • General Security Standards and WAF Support
    • ASM - Virtual Edition (VE) Tips
    • How to Bypass ASM Module
    • ASM Traffic Processing Daemon (bd)
    • ASM and AAM Integration
  • BIG-IP LTM Technology
    • Source IP Address and PORT Translation in BIG-IP
    • Packet Filters
    • Traffic / Service Profiles in BIG-IP
    • Virtual Servers and Their Behavior with Different Profiles in BIG-IP
      • Detailed Overview of Profiles in BIG-IP LTM
      • Optimizing for Mobile Clients in BIG-IP LTM
      • Connection Mirroring in BIG-IP LTM
      • AVR (Analytics) Profile in BIG-IP LTM
      • Health Monitoring in BIG-IP LTM
      • SSL Profile in BIG-IP LTM
      • Load-balancing Methods in BIG-IP LTM
      • Persistence Profile in BIG-IP
      • CMP vs. SMP in BIG-IP Systems
      • OneConnect Profile in BIG-IP
Powered by GitBook
On this page
  1. BIG-IP LTM Technology

Virtual Servers and Their Behavior with Different Profiles in BIG-IP

A Virtual Server in BIG-IP defines how traffic is processed for a specific service or application. Based on the profiles assigned to the virtual server, the behavior of the traffic flow, including handshakes and data exchange, can differ. Below, I’ll provide a detailed explanation of different virtual server configurations, highlighting the traffic flow and the handshakes involved, along with a text graph to illustrate the flow.

1. "Standard" Virtual Server with Only "TCP" Profile

When you configure a Standard Virtual Server with only a TCP Profile, the server will handle only the TCP-level interactions between the client and the server.

Behavior:

  • The virtual server waits for the 3-Way Handshake from the client-side.

  • Once the handshake is completed, the server immediately starts the 3-Way Handshake from the server-side.

Client → 3-Way Handshake → Virtual Server (TCP Profile) → 3-Way Handshake → Server

Flow Description:

  1. Client Side: The client initiates the TCP 3-Way Handshake with the server.

  2. Virtual Server: The virtual server waits for the handshake from the client-side, then completes the handshake and forwards the connection to the server.

  3. Server Side: The server receives the handshake, and the connection is established.

2. "Standard" Virtual Server with Both "TCP" and "Layer-7 Profile" like "HTTP"

When a Layer-7 Profile (e.g., HTTP profile) is added to the virtual server, it involves both TCP-level interaction and application-level processing.

Behavior:

  • The virtual server waits for both the 3-Way Handshake and application data (e.g., HTTP requests) from the client-side.

  • After receiving the 3-Way Handshake and application data, the server-side TCP Handshake is initiated.

Client → 3-Way Handshake + HTTP Data → Virtual Server (TCP + HTTP Profile) → 3-Way Handshake → Server

Flow Description:

  1. Client Side: The client initiates the TCP 3-Way Handshake, and during this process, it may also send HTTP Application Data (e.g., HTTP GET requests).

  2. Virtual Server: The virtual server processes the TCP Handshake and expects the application data (HTTP).

  3. Server Side: Once the handshake and application data are processed, the virtual server initiates the server-side TCP 3-Way Handshake, and the data is forwarded to the server.

3. "Standard" Virtual Server with Both "TCP" and "Layer-7 Profile" like "FTP"

When an FTP Profile is used, the virtual server only waits for the TCP 3-Way Handshake from the client, but it also requires the client to receive the FTP Greeting Banner before sending any data.

Behavior:

  • The virtual server waits for the 3-Way Handshake from the client-side.

  • After the 3-Way Handshake, it expects the client to receive the FTP Greeting Banner from the server before initiating any further data exchange.

Client → 3-Way Handshake → Virtual Server (TCP + FTP Profile) → Greeting Banner → Server

Flow Description:

  1. Client Side: The client initiates the TCP 3-Way Handshake.

  2. Virtual Server: The virtual server waits for the handshake and sends the FTP Greeting Banner.

  3. Server Side: The server completes the server-side handshake and sends the FTP Greeting Banner before further communication occurs.

Summary of Virtual Server Types

Virtual Server Type

Profile(s)

Handshake Process

TCP Profile Only

TCP Profile

Waits for Client-side 3-Way Handshake, then Server-side 3-Way Handshake

TCP + HTTP Profile

TCP Profile, HTTP Profile

Waits for Client-side 3-Way Handshake + HTTP Data, then Server-side 3-Way Handshake

TCP + FTP Profile

TCP Profile, FTP Profile

Waits for Client-side 3-Way Handshake, then immediately starts the Server-side handshake after the FTP Greeting Banner

PreviousTraffic / Service Profiles in BIG-IPNextDetailed Overview of Profiles in BIG-IP LTM

Last updated 3 months ago