Optimising Enterprise App Delivery with F5 BIG-IP iRules & SSL Offloading

F5 BIG-IP Local Traffic Manager (LTM) is the gold standard for enterprise-grade application delivery. When you have thousands of concurrent sessions hitting your web applications, the overhead of establishing TLS handshakes on backend application servers — each requiring expensive asymmetric cryptography operations — becomes a significant performance bottleneck.

SSL offloading moves this processing burden to the F5 BIG-IP hardware's dedicated SSL acceleration chips, allowing application servers to focus exclusively on business logic. The results are dramatic: 40% latency reduction and significant reduction in application server CPU overhead in production deployments I've managed.

Production-Ready iRule: HTTP to HTTPS Redirect & Security Headers

iRules are F5's TCL-based scripting engine that allow fine-grained traffic manipulation. The following production iRule enforces HTTPS and injects modern security headers on every response — eliminating the need to configure these at the application layer on every individual server in the pool.

when HTTP_REQUEST {
    # Force HTTPS Redirect — intercept all HTTP (port 80) requests
    if { [SSL::payload] eq "" } {
        HTTP::redirect "https://[HTTP::host][HTTP::uri]"
    }
}

when HTTP_RESPONSE {
    # HTTP Strict Transport Security (HSTS) — 1 year, all subdomains
    HTTP::header insert Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

    # Clickjacking Protection
    HTTP::header insert X-Frame-Options "SAMEORIGIN"

    # MIME Type Sniffing Prevention
    HTTP::header insert X-Content-Type-Options "nosniff"

    # XSS Protection (legacy browsers)
    HTTP::header insert X-XSS-Protection "1; mode=block"

    # Referrer Policy
    HTTP::header insert Referrer-Policy "strict-origin-when-cross-origin"
}

SSL Client & Server Profiles Configuration

The core SSL offloading configuration in BIG-IP involves two profiles:

• Client SSL Profile: Handles the TLS handshake between the client browser and the BIG-IP. Configure your production certificate and key here. Enable TLS 1.2/1.3 only; disable TLS 1.0 and 1.1.
• Server SSL Profile: Optionally re-encrypts traffic between BIG-IP and the backend pool members (recommended for PCI-DSS environments). For internal networks with strong physical security, plain HTTP to the backend is acceptable and eliminates double-encryption overhead.

Advanced Health Monitors

Custom HTTP health monitors with regex response validation ensure only healthy pool members receive traffic:

ltm monitor http my_app_health_check {
    defaults-from http
    send "GET /api/health HTTP/1.1\r\nHost: app.internal\r\nConnection: close\r\n\r\n"
    recv "\"status\":\"healthy\""
    interval 10
    timeout 31
    recv-disable "\"status\":\"maintenance\""
}

Key Performance Results

• 40% Latency Reduction: Hardware-accelerated SSL handshakes via BIG-IP's dedicated Cavium NITROX SSL chips eliminate the per-connection cryptographic overhead from application servers.
• TCP Express Profile: Custom TCP profile with optimized window sizes (recv-window-size: 131072) and SACK enabled for high-bandwidth WAN links reduces retransmission events.
• OneConnect Profile: Connection multiplexing allows a single backend TCP connection to serve multiple client requests — dramatically reducing backend connection table pressure during peak traffic.
• Compression Profile: HTTP/GZIP compression for text-based content (HTML, CSS, JS, JSON) reduces bandwidth consumption by up to 70% for typical web application payloads.