4

We have a Cisco 4700 ACE Router/Load Balancer which sits on the outside of our DMZ.

In addition we have that forward network traffic in round-robin mode to 2 IIS servers. We have opened up SSL port 443 to the router from outside and set-up a SSL certificate on both IIS servers with the correct bindings to the certificates. The certificate is valid and the Root certificate is also trusted.

Whenever when we connect to the router, we receive TCP packets on 443 on the server receiving the request, but then the connection stops and in the web browser get "No data received".

Is it even possible to have SSL working on servers behind the router or does the SSL need to be terminated at the point the request comes in?

If the current set-up is ok, what is the issue?

Just to give some extra information, when we trace the packets into the IIS server, the last packet before no packets are sent is a HTTPS RST, ACK packet.

1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 8 '17 at 18:06
3

Load balancing SSL is tricky. (I and several coworkers hold a patent on how to do it without decoding the traffic.) If you have a 1:1 NAT, there should be no problems... everything always goes to the same place. If you have connections bouncing between hosts, problems will start to pop up unless the SSL servers have a shared SSL session cache -- I don't think IIS can. Without a shared cache, session resumes will not be possible when a connection is sent to a different server.

The most common (patent unencumbered) way to do this is, as you mentioned, by handling SSL at a single point and then load balancing from there to internal SSL or non-SSL servers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.