Forum Discussion

thistuffjuice_3's avatar
thistuffjuice_3
Icon for Altostratus rankAltostratus
Sep 14, 2017

F5 LTM HTTP-HTTPS Re-Direct Using iRules - Virtual Server Config Question

Hello

 

For the following scenario, please can you provide best recommendations?

 

A Virtual-Server is UP, all working with a front-end listener on TCP443 (HTTPS) and serving to back-end Pool-Member's (HTTP web application) on a different TCP port from 443/80 running over SSL (SSL offload is being performed by the pool-members and not LTM) - No Server-Side or Client-Side SSL profile.

 

We want to introduce access on HTTP (TCP80), but ensure that the re-direction is taking place to force any client HTTP web request's to HTTPS... Therefore I would presume an iRule??? (Something like the below)

 

when HTTP_REQUEST {

 

HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri]

 

}

 

Now my main question:

 

1) Do you apply this iRule to the existing Virtual-Server listening on TCP443?

 

2) Do you clone the Virtual-Server and its config, but set the front-end destination service-port (listener) on TCP80 (HTTP)? Then apply the iRule (performing HTTP->HTTPS re-direct) to this VIP?

 

2a) If option 2, do you still clone the back-end pool member's etc? Or can the F5 intelligently see the listener and therefore perform as a re-direct only?

 

3) Any other better/alternate suggestions?

 

From the 201 TMOS studies I did, the study-guide says the processing order for a front-end Virtual-Server when inbound traffic is coming into the LTM is the following:

 

ip:port

 

ip:any

 

network:port

 

any:port

 

network:any

 

vlan:port

 

vlan:any

 

any:any

 

Before, I thought that you would need an extra VIP and not able to apply the iRule on the 443-VIP as it would drop traffic. However, from the above would it process in top-down order and hit the ip:any, anyway?

 

Many thanks!

 

application delivery
iRules
LTM
  • Jad_Tabbara__J1's avatar
    Jad_Tabbara__J1
    Icon for Cirrostratus rankCirrostratus
    Sep 14, 2017

    Hi,

     

    To do this you need two VS (VS_443 and VS_80).

     

    1) Apply this irule on VS_80

     

    2) Create a new VS that listen to the same VIP on service 80. If this VS is intended to make only HTTP to HTTPs redirectiong you ONLY need following objects applied to this VS_80 :

     

    • tcp profile

       

    • http profile

       

    • irule_redirect

       

    Regards

     

  • settembre17_332's avatar
    settembre17_332
    Icon for Nimbostratus rankNimbostratus
    Sep 14, 2017

    You could, via iRule, have the virtual server listen on both TCP 80 and TCP 443.

     

    For TCP 443, you could continue doing what you're doing.

     

    For TCP 80, you could:

     

    1. do the redirect, then
    2. insert the client cert into the request header, then
    3. send the traffic to the pool just as you currently do for traffic on TCP 443