F5 SSL VPN
Experimental support for F5 SSL VPN was added to OpenConnect in March 2021. It is also known as BIG-IP in some documentation. It is a PPP-based protocol using the native PPP support which was merged into the 9.00 release.
F5 mode is requested by adding --protocol=f5 to the command line:
openconnect --protocol=f5 big-ip.example.com
Since TCP over TCP is very suboptimal, OpenConnect tries to always use PPP-over-DTLS, and will only fall over to the PPP-over-TLS tunnel if that fails, or if disabled via the --no-dtls argument.
Quirks and Issues
Currently, OpenConnect should fully support basic username/password authentication for F5, along with an optional TLS client certificate and the "domain" dropdown used by some F5 VPNs. The domain form field can be automatically populated with the --authgroup command-line option.
Like Juniper, the F5 VPN expects a full web browser environment for authentication, and uses HTML forms which rely heavily on JavaScript. In some cases, JavaScript is used to inject modified values into hidden form fields, without which authentication will not complete successfully. If, as in #493, your F5 VPN uses a hidden form field with a value that must be overridden, you may be able to work around this by running openconnect --protocol=f5 --form-entry="hidden_form:choice=1" or similar (see issue for details on how this was determined).
If you have access to an F5 VPN which uses other types of authentication (e.g. RSA or OATH tokens), please send information to the mailing list so that we add support to OpenConnect.
Connectivity over DTLS is supported. On BIG-IP server v16, it is possible to use either DTLSv1.0 or DTLSv1.2, if configured correctly. On BIG-IP server v15, it is limited to DTLSv1.0 because experiments show that BIG-IP server v15 cannot negotiate correctly down to DTLSv1.0 when a newer version of DTLS is attempted.