Currently I'm working on Riverbed steelhead.

My question is all our Riverbed in production is working with default inpath rules in place,I found the port labels include 443,this means my device not optimising SSL connection?,kindly explain

  • 1
    Welcome to Network Engineering. Please edit your question to include the full configuration. We don't want to guess at the answer. – Ron Trunk Oct 10 at 12:11
  • 1
    Use the Report feature. Choose Reports > Rules Statistics. This shows your current In-Path working status. – Roger Sanghee Gold Oct 12 at 6:41

By default Riverbed SteelHeads will have port 443 in the passthrough list, you are correct. They are capable of optimizing encrypted SSL traffic if properly configured, but do not do so out-of-the box.

By default, Riverbed Steelhead will not try to optimize three types of traffic:

  • Encrypted traffic such as SSH, HTTP or IMAPS
  • Traffic for interactive applications such as telnet or remote desktop
  • Traffic used to manage and operate the Steelhead itself

This is achieved by means of the default in-path rules, which set to passthrough the default ports for such protocols.

This section of the Steelhead Management Console User´s Guide describes the default in-path rules and lists all ports set to passthrough by default

In my opinion it makes sense that default in-path rules are set to avoid optimization of encrypted traffic:

  • With proper encryption, encrypted payload is similar to random noise.
  • Trying to apply compression, deduplication and indexation algorithms (as Steelahead does as part of the optimization processes) to random noise will cause computing overhead but will offer very poor results.

If you need to perform SSL optimization, you will need to apply specific configurations. The chapter SSL deployment in the Steelhead Deployment Guide could be useful for you:

The Riverbed SSL solution optimizes data transfers that are encrypted using SSL, provided that SteelHeads are deployed locally to both the client-side and server-side of the network. All of the same optimized connections that are applied to normal nonencrypted TCP traffic, you can also apply to encrypted SSL traffic. SteelHeads accomplish this without compromising end-to-end security and the established trust model.

According to the list of required components for SSL optimization, apart from certificates, you may need additional licenses:

SSL Optimization Required Components

You need the following SSL components to deploy SSL on SteelHeads:

  • Enhanced Cryptography License Key
  • Proxy Certificate and Private Key
  • Certificate Chain Discovery
  • Certificate Authority Certificates
  • Peer Certificates

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.