Search code examples
azuretls1.2hstsazure-traffic-managerazure-application-gateway

Can Azure Traffic Manager redirect clients based on SSL version?


I want all clients to be able to access my server regardless of how old or unpatched they are.

This means I need to support ancient versions of SSL. I want these users to access sales and marketing material on my site, However, I don't want those versions to special pages.

This configuration is necessary because I want to support HSTS, but client's won't conditionally honor an HSTS header based on TLS version or cipher.

That means the load balancer (Netscaler equivalent) needs to redirect based on cipher or protocol version.

How can I ensure Traffic Manager (or any other relevant aspect to Azure) satisfies this need


Solution

  • Traffic Manager is a DNS only solution. It doesn't terminate connections.

    Look at Azure Application Gateway for a Layer 7 load balancer:
    https://azure.microsoft.com/en-us/documentation/articles/application-gateway-introduction/

    I'm unsure if it can match on TLS protocol version but you can give it a go.