BIG-IP LTM VE : How to decrypt SSL traffic on LTM with ssldump

Here’s an explanation of how to decrypt SSL traffic with ssldump which has been installed on LTM devices.

Network topology

Client – vSW – LTM – vSW – Server*2

Client , LTM and two Servers are running on ESXi.

[root@ltm1:Active] ~ # b version | head -5 Kernel: Linux 2.6.18-164.2.1.el5.1.0.f5app Package: BIG-IP Version 10.1.0 3341.1084 Final Edition

[ create Virtual Servers for HTTPS ]

Before creating a Virtual Server for HTTPS , create Nodes and Pools.

Here’s a Vitual Server for HTTPS

Choose “clientssl” , which has been install on LTM by default , as SSL Profile (Client)

bigip.conf

node 192.168.0.100 {   monitor icmp   screen s1-ipv4 } node 192.168.0.101 {   monitor icmp   screen s2-ipv4 } pool http-ipv4 {   monitor all http   members {      192.168.0.100:http {}      192.168.0.101:http {}   } } virtual vs-https {   pool http-ipv4   destination 10.0.0.100:https   ip protocol tcp   persist cookie   profiles {      clientssl {         clientside      }      http {}      tcp {}   } }

[ access to the VIP from a client ]

confirm that you could access to the VIP.

[ ssldump on LTM ]

ssldump has been installed on LTM by default.

Please note that you could decrypt SSL traffic under the following conditions.

ssldump  can  decrypt traffic between two hosts if the following       two conditions are met:              1. ssldump has the keys.              2. Static RSA was used.

private key of “clientssl” profile is stored under /config/ssl/ssl.key directory.

[root@ltm1:Active] ~ # ssldump -k /config/ssl/ssl.key/default.key -i 1.1 port 443 -A -d    New TCP connection #1: 10.0.0.10(42572) <-> 10.0.0.100(443) 1 1  0.0011 (0.0011)  C>SV3.1(89)  Handshake      ClientHello        Version 3.1        random[32]=          4f 26 54 e3 a8 e1 a4 d4 a0 8c c1 11 ad a2 fe cb          c9 7f 3d ff 4b 58 65 6c 1c 28 c9 2c 4e 88 de 8c        cipher suites        Unknown value 0xff        Unknown value 0x88        Unknown value 0x87        TLS_DHE_RSA_WITH_AES_256_CBC_SHA        TLS_DHE_DSS_WITH_AES_256_CBC_SHA        Unknown value 0x84        TLS_RSA_WITH_AES_256_CBC_SHA        Unknown value 0x45        Unknown value 0x44        TLS_DHE_RSA_WITH_AES_128_CBC_SHA        TLS_DHE_DSS_WITH_AES_128_CBC_SHA        Unknown value 0x96        Unknown value 0x41        TLS_RSA_WITH_RC4_128_MD5        TLS_RSA_WITH_RC4_128_SHA        TLS_RSA_WITH_AES_128_CBC_SHA        TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA        TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA        Unknown value 0xfeff        TLS_RSA_WITH_3DES_EDE_CBC_SHA        compression methods                  NULL 1 2  0.0013 (0.0002)  S>CV3.1(48)  Handshake      ServerHello        Version 3.1        random[32]=          4f 26 54 e3 99 85 29 14 f9 26 a2 a2 0d 68 7f 6e          ae 49 2d 4c d0 3b af d4 7d 67 ff 83 a1 77 a3 9e        session_id[0]=        cipherSuite         TLS_RSA_WITH_AES_256_CBC_SHA        compressionMethod                   NULL 1 3  0.0013 (0.0000)  S>CV3.1(692)  Handshake      Certificate 1 4  0.0013 (0.0000)  S>CV3.1(4)  Handshake      ServerHelloDone 1 5  0.0375 (0.0362)  C>SV3.1(134)  Handshake      ClientKeyExchange        EncryptedPreMasterSecret[128]=          15 b1 e0 a9 db 90 19 49 12 82 3b e4 60 cd bf eb          5d 6a fe 05 67 05 19 1f 07 1b 8d 0d ce 9e d4 0d          2d 90 92 1a c8 5e 5d 57 18 b0 03 53 ad 19 a8 a1          17 33 e0 25 30 71 3d 30 7e 07 67 ba c3 f4 ee 36          6e d8 8a 42 5d 34 cc d1 82 30 ed 5a dc 4c 3f df          9a 9b ed 53 a6 2c 62 9b b8 0f 72 43 02 a8 1c 60          e5 aa 69 4a c7 b1 74 28 93 cb 1d dd 65 58 00 41          2a 75 fb 33 17 32 59 3f ca 35 52 54 aa 95 d3 a1 1 6  0.0375 (0.0000)  C>SV3.1(1)  ChangeCipherSpec 1 7  0.0375 (0.0000)  C>SV3.1(48)  Handshake      Finished        verify_data[12]=          97 48 73 91 a0 ea 37 d4 74 c8 9c c4 1 8  0.0408 (0.0033)  S>CV3.1(170)  Handshake 1 9  0.0408 (0.0000)  S>CV3.1(1)  ChangeCipherSpec 1 10 0.0408 (0.0000)  S>CV3.1(48)  Handshake      Finished        verify_data[12]=          8c 91 bd e5 93 c4 36 34 80 53 49 24 1 11 0.0419 (0.0011)  C>SV3.1(416)  application_data    ---------------------------------------------------------------    GET / HTTP/1.1    Host: 10.0.0.100    User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.24) Gecko/20111108 Red Hat/3.6.24-3.el6_1 Firefox/3.6.24    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8    Accept-Language: en-us,en;q=0.5    Accept-Encoding: gzip,deflate    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7    Keep-Alive: 115    Connection: keep-alive        --------------------------------------------------------------- 1 12 0.0443 (0.0023)  S>CV3.1(352)  application_data    ---------------------------------------------------------------    HTTP/1.1 200 OK    Date: Mon, 30 Jan 2012 08:29:23 GMT    Server: Apache/2.2.15 (Scientific Linux)    Last-Modified: Mon, 05 Sep 2011 05:55:49 GMT    ETag: "443e5-6-4ac2b5ce8a846"    Accept-Ranges: bytes    Content-Length: 6    Connection: close    Content-Type: text/html; charset=UTF-8    Set-Cookie: lbcookie=1694542016.20480.0000; path=/        --------------------------------------------------------------- 1 13 0.0443 (0.0000)  S>CV3.1(32)  application_data    ---------------------------------------------------------------    SL6-3    --------------------------------------------------------------- 1    0.0443 (0.0000)  S>C  TCP FIN 1 14 0.0454 (0.0010)  C>SV3.1(32)  Alert    level           warning    value           close_notify 1    0.0486 (0.0032)  C>S  TCP FIN New TCP connection #2: 10.0.0.10(42573) <-> 10.0.0.100(443) 2 1  0.0011 (0.0011)  C>SV3.1(281)  Handshake      ClientHello        Version 3.1        random[32]=          4f 26 54 e4 7e 4a 05 b5 ea f1 20 6c 13 39 a8 bf          91 b9 6f 4b 19 a9 d1 d4 26 ee d1 45 a6 1a 5a b7        resume [32]=          b0 f9 74 fb 02 41 00 40 e8 28 b5 85 b5 5f 0b c9          ed 7d 2f 7d 6c d1 78 37 e4 08 6d bf ca 22 22 2f        cipher suites        Unknown value 0xff        Unknown value 0x88        Unknown value 0x87        TLS_DHE_RSA_WITH_AES_256_CBC_SHA        TLS_DHE_DSS_WITH_AES_256_CBC_SHA        Unknown value 0x84        TLS_RSA_WITH_AES_256_CBC_SHA        Unknown value 0x45        Unknown value 0x44        TLS_DHE_RSA_WITH_AES_128_CBC_SHA        TLS_DHE_DSS_WITH_AES_128_CBC_SHA        Unknown value 0x96        Unknown value 0x41        TLS_RSA_WITH_RC4_128_MD5        TLS_RSA_WITH_RC4_128_SHA        TLS_RSA_WITH_AES_128_CBC_SHA        TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA        TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA        Unknown value 0xfeff        TLS_RSA_WITH_3DES_EDE_CBC_SHA        compression methods                  NULL 2    28.1854 (28.1842)  C>S  TCP FIN 2    28.1854 (0.0000)  S>C  TCP FIN New TCP connection #3: 10.0.0.10(42574) <-> 10.0.0.100(443) 3 1  0.0011 (0.0011)  C>SV3.1(281)  Handshake      ClientHello        Version 3.1        random[32]=          4f 26 54 ff c4 f5 10 80 9d 56 2d 64 66 e0 ff 29          56 04 bf 1b 03 f6 5a 5e d0 25 c5 fc 1d 0b 69 d4        resume [32]=          b0 f9 74 fb 02 41 00 40 e8 28 b5 85 b5 5f 0b c9          ed 7d 2f 7d 6c d1 78 37 e4 08 6d bf ca 22 22 2f        cipher suites        Unknown value 0xff        Unknown value 0x88        Unknown value 0x87        TLS_DHE_RSA_WITH_AES_256_CBC_SHA        TLS_DHE_DSS_WITH_AES_256_CBC_SHA        Unknown value 0x84        TLS_RSA_WITH_AES_256_CBC_SHA        Unknown value 0x45        Unknown value 0x44        TLS_DHE_RSA_WITH_AES_128_CBC_SHA        TLS_DHE_DSS_WITH_AES_128_CBC_SHA        Unknown value 0x96        Unknown value 0x41        TLS_RSA_WITH_RC4_128_MD5        TLS_RSA_WITH_RC4_128_SHA        TLS_RSA_WITH_AES_128_CBC_SHA        TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA        TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA        Unknown value 0xfeff        TLS_RSA_WITH_3DES_EDE_CBC_SHA        compression methods                  NULL [root@ltm1:Active] ~ #

BIG-IP : configure IPv4 , IPv6 dual stack virtual servers

Here’s an explanation of how to set up IPv4/IPv6 virtual servers.

Client IPv4 <--> VIP IPv4 <--> Server IPv4

Client IPv6 <--> VIP IPv6 <--> Server IPv6

# b version | head -5 Kernel: Linux 2.6.18-164.2.1.el5.1.0.f5app Package: BIG-IP Version 10.1.0 3341.1084 Final Edition

Client : 10.0.0.10 , 2000:aaaa:0:1:::100  | vSwitch  |  | VIP : 10.0.0.100 , 2000:aaaa:0:1::80  |serlf IP: 1.1 : 10.0.0.1 , 2000:aaaa:0:1::1/64 LTM  ----------------------------  |self IP: 1.2 : 192.168.0.1 , 2000:aaaa:0:a::1/64  | vSwitch  | Apache Server1 , Apache Server2

Server1(Scientific Linux 6) : 192.168.0.100 , 2000:aaaa:0:a::2/64

Server2 (Scientific Linux 6): 192.168.0.101 , 2000:aaaa:0:a::3/64

[ configure IPv6 addresses on LTM’s self IP ]

GUI -> Network -> Self IPs

- bigip_base.conf

vlan external {   tag 4094   interfaces 1.1 } vlan internal {   tag 4093   interfaces 1.2 } self 10.0.0.1 {   netmask 255.255.255.0   vlan external   allow default } self 192.168.0.1 {   netmask 255.255.255.0   vlan internal   allow default } self 2000:aaaa:0:1::1 {   netmask ffff:ffff:ffff:ffff::   vlan external   allow default } self 2000:aaaa:0:a::1 {   netmask ffff:ffff:ffff:ffff::   vlan internal   allow default }

[ configure nodes and pools ]

Local Traffic -> Nodes

create four nodes ( s1-ipv4 , s1-ipv6 , s2-ipv4 , s2-ipv6 )

bigip.conf

node 192.168.0.100 {   screen s1-ipv4 } node 192.168.0.101 {   screen s2-ipv4 } node 2000:aaaa:0:a::2 {   screen s1-ipv6 } node 2000:aaaa:0:a::3 {   screen s2-ipv6 }

create pools

Local Traffic -> Pools -> Create

This pool is for IPv4

This pool is for IPv6

bigip.conf

pool http-ipv4 {   monitor all http   members {      192.168.0.100:http {}      192.168.0.101:http {}   } } pool http-ipv6 {   monitor all http   members {      2000:aaaa:0:a::2.http {}      2000:aaaa:0:a::3.http {}   } }

[ configure virtual servers ]

VIP : VIP : 10.0.0.100 , 2000:aaaa:0:1::80

Local Traffic -> Virtual Servers -> Create

This is for IPv4

Client : IPv4 --- VIP : IPv4 --- Server : IPv4

This is for IPV6

Client : IPv6 --- VIP : IPv6 --- Server : IPv6

bigip.conf

virtual http-ipv4 {   pool http-ipv4   destination 10.0.0.100:http   ip protocol tcp   persist cookie   profiles {      http {}      tcp {}   } } virtual http-ipv6 {   pool http-ipv6   destination 2000:aaaa:0:1::80.http   ip protocol tcp   persist cookie   profiles {      http {}      tcp {}   } }

[ configure Server’s IP address (Scientific Linux 6) ]

Server1

[root@sl6-2 ~]# cat /etc/sysconfig/network NETWORKING=yes HOSTNAME=sl6-2.localdomain [root@sl6-2 ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth0 DEVICE="eth0" HWADDR="00:0C:29:zz:zz:zz" NM_CONTROLLED="yes" ONBOOT="yes" PROTO="static" IPADDR=192.168.0.100 NETMASK=255.255.255.0 GATEWAY=192.168.0.1 IPV6INIT=yes IPV6ADDR=2000:aaaa:0:a::2 IPV6_DEFAULTGW=2000:aaaa:0:a::1 # ifconfig | grep inet          inet addr:192.168.0.100  Bcast:192.168.0.255  Mask:255.255.255.0          inet6 addr: 2000:aaaa:0:a::2/64 Scope:Global          inet6 addr: fe80::20c:29ff:fe5c:6a4b/64 Scope:Link          inet addr:127.0.0.1  Mask:255.0.0.0          inet6 addr: ::1/128 Scope:Host # route -n -A inet6 Kernel IPv6 routing table Destination                                 Next Hop                                Flags Metric Ref    Use Iface 2000:aaaa:0:a::1/128                        2000:aaaa:0:a::1                        UC    0      2194       0 eth0     2000:aaaa:0:a::/64                          ::                                      U     256    1        0 eth0     fe80::/64                                   ::                                      U     256    0        0 eth0     ::/0                                        2000:aaaa:0:a::1                        UG    1      0        0 eth0     ::1/128                                     ::                                      U     0      3        1 lo       2000:aaaa:0:a::2/128                        ::                                      U     0      839       1 lo       fe80::20c:29ff:fe5c:6a4b/128                ::                                      U     0      138       1 lo       ff00::/8                                    ::                                      U     256    0        0 eth0

Server2

# cat /etc/sysconfig/network NETWORKING=yes HOSTNAME=sl6-3.localdomain [root@sl6-3 ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth0 DEVICE="eth0" NM_CONTROLLED="yes" ONBOOT="yes" PROTO="static" IPADDR=192.168.0.101 NETMASK=255.255.255.0 GATEWAY=192.168.0.1 IPV6INIT=yes IPV6ADDR=2000:aaaa:0:a::3 IPV6_DEFAULTGW=2000:aaaa:0:a::1 # ifconfig | grep inet          inet addr:192.168.0.101  Bcast:192.168.0.255  Mask:255.255.255.0          inet6 addr: 2000:aaaa:0:a::3/64 Scope:Global          inet6 addr: fe80::20c:29ff:feab:bfad/64 Scope:Link          inet addr:127.0.0.1  Mask:255.0.0.0          inet6 addr: ::1/128 Scope:Host

Flush iptables and ip6tables settings.

# ip6tables -F # iptables –F # ip6tables -L -n Chain INPUT (policy ACCEPT) target     prot opt source               destination          Chain FORWARD (policy ACCEPT) target     prot opt source               destination          Chain OUTPUT (policy ACCEPT) target     prot opt source               destination          # iptables -L -n Chain INPUT (policy ACCEPT) target     prot opt source               destination          Chain FORWARD (policy ACCEPT) target     prot opt source               destination          Chain OUTPUT (policy ACCEPT) target     prot opt source               destination

[ configure the Apache servers ]

Listen on IPv4 and IPv6.

Start httpd

# egrep -i ^listen /etc/httpd/conf/httpd.conf Listen 80 # /etc/init.d/httpd start

[ check the health monitor status ]

logon to the LTM and issue bigtop to check the nodes status.

All nodes are UP status.

# bigtop                      |  bits  since  |  bits  in prior    |  current                     |  Jan 15 21:03:25   |  0 seconds         |  time BIG-IP      ACTIVE   |---In----Out---Conn-|---In----Out---Conn-|  01:09:18 ltm1.localdomain      4.041M 4.135M   3425 0      0      0 VIRTUAL ip:port      |---In----Out---Conn-|---In----Out---Conn-|-Nodes Up-- 10.0.0.100:http            0  0 0 0      0      0      2 2000:aaaa:0:1::80.htt   0  0 0 0      0      0      2 NODE ip:port         |---In----Out---Conn-|---In----Out---Conn-|--State---- 192.168.0.101:http         0  0 0 0      0      0 UP 192.168.0.100:http         0  0 0 0      0      0 UP 2000:aaaa:0:a::2.http   0  0 0 0      0      0 UP 2000:aaaa:0:a::3.http   0  0 0 0      0      0 UP

Here’s an excerpt of the capture data captured on the Apache server.

IPv4

Apache : 192.168.0.100

LTM self IP : 192.168.0.1

# tshark -i eth0 port 80 | grep "192.168.0"  1.001369  192.168.0.1 -> 192.168.0.100 TCP 60275 > http [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=3856227756 TSER=0 WS=7  1.001398 192.168.0.100 -> 192.168.0.1  TCP http > 60275 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 TSV=5291523 TSER=3856227756 WS=5  1.010638  192.168.0.1 -> 192.168.0.100 TCP 60275 > http [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=3856227757 TSER=5291523  1.011670  192.168.0.1 -> 192.168.0.100 HTTP GET /  1.011701 192.168.0.100 -> 192.168.0.1  TCP http > 60275 [ACK] Seq=1 Ack=10 Win=5792 Len=0 TSV=5291533 TSER=3856227757

IPv6

Apache : 2000:aaaa:0:a::2

LTP self IP : 2000:aaaa:0:a::1

# tshark -i eth0 port 80 | grep "2000:"  2.001845 2000:aaaa:0:a::1 -> 2000:aaaa:0:a::2 TCP 40499 > http [SYN] Seq=0 Win=5760 Len=0 MSS=1440 TSV=3856274857 TSER=0 WS=7  2.001891 2000:aaaa:0:a::2 -> 2000:aaaa:0:a::1 TCP http > 40499 [SYN, ACK] Seq=0 Ack=1 Win=5712 Len=0 MSS=1440 TSV=5335492 TSER=3856274857 WS=5  2.010144 2000:aaaa:0:a::1 -> 2000:aaaa:0:a::2 TCP 40499 > http [ACK] Seq=1 Ack=1 Win=5760 Len=0 TSV=3856274858 TSER=5335492  2.011195 2000:aaaa:0:a::1 -> 2000:aaaa:0:a::2 HTTP GET /  2.011227 2000:aaaa:0:a::2 -> 2000:aaaa:0:a::1 TCP http > 40499 [ACK] Seq=1 Ack=10 Win=5728 Len=0 TSV=5335501 TSER=3856274858  2.011464 2000:aaaa:0:a::2 -> 2000:aaaa:0:a::1 HTTP Continuation or non-HTTP traffic  2.011579 2000:aaaa:0:a::2 -> 2000:aaaa:0:a::1 TCP http > 40499 [FIN, ACK] Seq=7 Ack=10 Win=5728 Len=0 TSV=5335501 TSER=3856274858

[ access to the VIP from the client ]

Client : 10.0.0.10 , 2000:aaaa:0:a:::100

VIP : 10.0.0.100 , 2000:aaaa:0:1::80

- access to the IPv4 VIP

- access to the IPv6 VIP

Please note that you need to specify the IPv6 IP address as  http://[IPv6] in URL bar.

the capture data captured on the Client

Client : 10.0.0.10 , 2000:aaaa:0:a:::100

VIP : 10.0.0.100 , 2000:aaaa:0:1::80

# tshark -r aaa.pcap  1   0.000000 2000:aaaa:0:1::100 -> 2000:aaaa:0:1::80 TCP 56057 > http [SYN] Seq=0 Win=14400 Len=0 MSS=1440 TSV=702175 TSER=0 WS=6  2   0.001032 2000:aaaa:0:1::80 -> 2000:aaaa:0:1::100 TCP http > 56057 [SYN, ACK] Seq=0 Ack=1 Win=4320 Len=0 MSS=1440 TSV=3858489794 TSER=702175  3   0.001055 2000:aaaa:0:1::100 -> 2000:aaaa:0:1::80 TCP 56057 > http [ACK] Seq=1 Ack=1 Win=14400 Len=0 TSV=702177 TSER=3858489794  4   0.001157 2000:aaaa:0:1::100 -> 2000:aaaa:0:1::80 HTTP GET /favicon.ico HTTP/1.1  5   0.004364 2000:aaaa:0:1::80 -> 2000:aaaa:0:1::100 TCP [TCP segment of a reassembled PDU]  6   0.004378 2000:aaaa:0:1::100 -> 2000:aaaa:0:1::80 TCP 56057 > http [ACK] Seq=402 Ack=525 Win=15008 Len=0 TSV=702181 TSER=3858489798  7   0.004388 2000:aaaa:0:1::80 -> 2000:aaaa:0:1::100 HTTP HTTP/1.1 404 Not Found  (text/html)

the capture data captured on the server

Client : 10.0.0.10 , 2000:aaaa:0:a:::100

Server 2000:aaaa:0:a::2

# tshark -r server.pcap | grep "2000:aaaa:0:1::100" 61   8.000757 2000:aaaa:0:1::100 -> 2000:aaaa:0:a::2 TCP 56061 > http [SYN] Seq=0 Win=4320 Len=0 MSS=1440 TSV=3858713253 TSER=0 62   8.000803 2000:aaaa:0:a::2 -> 2000:aaaa:0:1::100 TCP http > 56061 [SYN, ACK] Seq=0 Ack=1 Win=5712 Len=0 MSS=1440 TSV=7610537 TSER=3858713253 63   8.001872 2000:aaaa:0:1::100 -> 2000:aaaa:0:a::2 TCP 56061 > http [ACK] Seq=1 Ack=1 Win=4320 Len=0 TSV=3858713254 TSER=7610537 64   8.001902 2000:aaaa:0:1::100 -> 2000:aaaa:0:a::2 HTTP GET / HTTP/1.1 65   8.001925 2000:aaaa:0:a::2 -> 2000:aaaa:0:1::100 TCP http > 56061 [ACK] Seq=1 Ack=493 Win=6432 Len=0 TSV=7610538 TSER=3858713254

I configured cookie persistence.

check whether the LTM inserted cookie or not.

# tshark -r server.pcap -V | grep -i cookie    Cookie: lbcookie=vi2000aaaa0000000a0000000000000002.20480\r\n    Cookie: lbcookie=vi2000aaaa0000000a0000000000000002.20480\r\n

The LTM inserted cookie.

[ LTM configuration ]

[root@ltm1:Active] config # [root@ltm1:Active] config # cat bigip.conf datastor {   low water mark 80   high water mark 92 } deduplication {} shell write partition Common monitor http_health_check {   defaults from http   recv "200 OK" } profile smtp smtp {   defaults from none   security enabled enable } profile persist cookie {   mode cookie   mirror disable   timeout immediate   cookie mode insert   cookie name "lbcookie"   cookie expiration immediate   cookie hash offset 0   cookie hash length 0   override connection limit disable   rule none } node 192.168.0.100 {   screen s1-ipv4 } node 192.168.0.101 {   screen s2-ipv4 } node 2000:aaaa:0:a::2 {   screen s1-ipv6 } node 2000:aaaa:0:a::3 {   screen s2-ipv6 } pool http-ipv4 {   monitor all http   members {      192.168.0.100:http {}      192.168.0.101:http {}   } } pool http-ipv6 {   monitor all http   members {      2000:aaaa:0:a::2.http {}      2000:aaaa:0:a::3.http {         session disable      }   } } virtual http-ipv4 {   pool http-ipv4   destination 10.0.0.100:http   ip protocol tcp   persist cookie   profiles {      http {}      tcp {}   } } virtual http-ipv6 {   pool http-ipv6   destination 2000:aaaa:0:1::80.http   ip protocol tcp   persist cookie   profiles {      http {}      tcp {}   } } [root@ltm1:Active] config # [root@ltm1:Active] config # [root@ltm1:Active] config # cat bigip_base.conf mgmt 1.1.1.10 {   netmask 255.255.255.0 } stp {   config name none } stp instance 0 {   interfaces {      1.1 {         external path cost 20000         internal path cost 20000      }      1.2 {         external path cost 20000         internal path cost 20000      }   }   vlans {      external      internal   } } self allow {   default {      tcp ssh      tcp domain      tcp snmp      tcp https      tcp f5-iquery      udp domain      udp snmp      udp efs      udp cap      udp f5-iquery      proto ospf   } } shell write partition Common vlan external {   tag 4094   interfaces 1.1 } vlan internal {   tag 4093   interfaces 1.2 } self 10.0.0.1 {   netmask 255.255.255.0   vlan external   allow default } self 192.168.0.1 {   netmask 255.255.255.0   vlan internal   allow default } self 2000:aaaa:0:1::1 {   netmask ffff:ffff:ffff:ffff::   vlan external   allow default } self 2000:aaaa:0:a::1 {   netmask ffff:ffff:ffff:ffff::   vlan internal   allow default } statemirror {   addr 172.27.39.38 } system {   gui setup disable   hostname "ltm1.localdomain" } [root@ltm1:Active] config #