ASM - pool to be defined in http class or in VIP ?

Hi Aaron,

 

 

Let make it more clear -

 

 

I am already having an irule in place and that is called in http virtual server and in the https virtual server I have defined the http class.

 

 

Now, I have not defined any pool in http virtual server, but I have defined the pool in https virtual server and in the http class.

 

 

My doubt is if we define the pool in the https virtual server and in the http class, we are saying that if there is not match in the http class the request will be directed to the default pool in the virtual server. So, don't you think its a security risk ?

 

 

Ideally, we should be defining the pool in the http class and put the default pool in the virtual server to none. I am new to ASM and my understanding could be wrong. I need your expert advice.

 

 

Rgds./

 

Joe.