For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Himanshu_Yadav_'s avatar
Himanshu_Yadav_
Icon for Nimbostratus rankNimbostratus
Sep 14, 2016

Facing sporadic issue with the redirection

Hi, we are facing sporadic issue with the redirection on "HTTP". Some times redirection works but sometimes it gives page not displayed.

 

Rule xyz-irule

 

when HTTP_REQUEST { switch -glob [string tolower [HTTP::host][HTTP::uri]] { "/abc" {HTTP::redirect "https://abc.xyz.com"} "/def" {HTTP::redirect "https://def.xyz.com"} "/ghi" {HTTP::redirect "https://ghi.xyz.com"} "*" {HTTP::redirect "http://www.test.xyz.com"}

 

IRules sequence iRules: xyz-irule : http_to_https_redirect : x-forwarding_Rule

 

I know 2nd rule is not applicable in this case because we have used "*" in first Rule, and not sure if X-Forwording rule is trying something which fails request sometimes.

 

rule x-forwarding_Rule

 

when HTTP_REQUEST { HTTP::header insert X-Forwarded-For [IP::remote_addr] } }

 

application delivery
BIG-IP
iRules

2 Replies

  • Vijay_E's avatar
    Vijay_E
    Icon for Cirrus rankCirrus
    Sep 14, 2016

    It looks like you are intending to match based on URI but your iRule is matching on both host header & URI: [string tolower [HTTP::host][HTTP::uri]]. If my understanding is right, you should use [string tolower [HTTP::uri]]

    If you any CDN traffic, try using OneConnect with /32 netmask.

    Use a combined iRule for simplicity:

    when HTTP_REQUEST { 
HTTP::header insert X-Forwarded-For [IP::remote_addr] 

switch -glob [string tolower [HTTP::uri]] { 
"/abc" {HTTP::redirect "https://abc.xyz.com"} 
"/def" {HTTP::redirect "https://def.xyz.com"} 
"/ghi" {HTTP::redirect "https://ghi.xyz.com"} 
"*" {HTTP::redirect "http://www.test.xyz.com"}
}
}
  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Sep 15, 2016

    Hi Himanshu,

    it doesn't make much sense for me to insert the 

    X-Forwarded-For
    header for every incomming requests if you continue to 
    HTTP::redirect
    every single requests.

    The 

    X-Forwarded-For
    header has no benefits for 
    HTTP::redirects
    and even worse it will just disrupt the ongoing TCP session if you try to manipulate the HTTP request after it has been already responded. In addition you will see the error message below in your LTM logs...

    Operation not supported (line 1) invoked from within "HTTP::header insert X-Forwarded-For [IP::remote_addr]"

    Cheers, Kai