Forum Discussion

Jair_Candia's avatar
Jair_Candia
Icon for Nimbostratus rankNimbostratus
Jun 29, 2022

Bypass Host

Hi

I have multiples websites hosted in same virtual server. But these websites are from differents domains; e.g. "corporate.com" and "corp.net"

"corp.net" use letsencrypt for the certificates, so these changes every 3 months. When I redirect traffic to BigIP virtual server I can access "corporate.com" but "corp.net" shows me SSL certificate warning and aint no able to access it, because it's getting the corporate.com certificate. Both websites use https.

I need an iRule to bypass the traffic of corp.net, I tried with:

when HTTP_REQUEST {
if { [HTTP::host] contains "corp.net"{
ASM::disable
SSL::disable clientside
SSL::disable serverside
pool pool_10.0.1.1
}
}

 

But it does not work. Any idea?

devops
  • CA_Valli's avatar
    CA_Valli
    Icon for MVP rankMVP
    Jul 04, 2022

    Hello Jair_Candia

    If I'm interpreting te problem right, you have SSL issue due to SNI mismatch when you access corp.net service.

    My guess would be, your VS might be missing SSL configuration. I wanted to understand better if you have any restraints in importing corp.net certificate on F5 because this will make configuration easier. 

    For multiple SNI support you can configure a second clientSSL profile with explicit "corp.net" SNI (or wildcard equivalent) and make "corporate.com" clientSSL profile default for all SNI. Of course, if certificate changes every three months you should remember to upload it on F5 every time. 

    If you need F5 to pass-through SSL for corp.net only, configuration is trickier. Easiest way, if possible, is to have different Virtual Servers - one with and one without SSL profiles.

    If they must coexist on same VS, you need to perform the SSL disable operations ar right time in traffic flow. HTTP_REQUEST event is too late since SSL handshake already happened. I believe your best bet would be CLIENT_ACCEPTED event - this is TCP handshake, but in this case you should write matching conditions based on TCP properties. Or, (I'm not sure about this), you might be able to disable SSL on CLIENTSSL_CLIENTHELLO event and in this case you should be able to match SNI. You should also disable serverSSL on matching serverside event.