Using SSL with Cisco Network Load balancer

Question

We have a Cisco 4700 ACE Router/Load Balancer which sits on the outside of our DMZ.

In addition we have that forward network traffic in round-robin mode to 2 IIS servers. We have opened up SSL port 443 to the router from outside and set-up a SSL certificate on both IIS servers with the correct bindings to the certificates. The certificate is valid and the Root certificate is also trusted.

Whenever when we connect to the router, we receive TCP packets on 443 on the server receiving the request, but then the connection stops and in the web browser get "No data received".

Is it even possible to have SSL working on servers behind the router or does the SSL need to be terminated at the point the request comes in?

If the current set-up is ok, what is the issue?

Just to give some extra information, when we trace the packets into the IIS server, the last packet before no packets are sent is a HTTPS RST, ACK packet.

Answer 1

Load balancing SSL is tricky. (I and several coworkers hold a patent on how to do it without decoding the traffic.) If you have a 1:1 NAT, there should be no problems... everything always goes to the same place. If you have connections bouncing between hosts, problems will start to pop up unless the SSL servers have a shared SSL session cache -- I don't think IIS can. Without a shared cache, session resumes will not be possible when a connection is sent to a different server.

The most common (patent unencumbered) way to do this is, as you mentioned, by handling SSL at a single point and then load balancing from there to internal SSL or non-SSL servers.