Forum Discussion
LTM DMZ Design Question
- Lucas_ThompsonAug 26, 2024Employee
I think you're missing one step to post-process the data.
This iRule snippet is used within SSL Orchestrator to catch the SNI so it's been tested extensively.
if {[SSL::extensions exists -type 0]} { binary scan [SSL::extensions -type 0] @9a* SNI if {[regexp {(?i)[^a-z0-9.-]} $SNI]} { log local0. "CLIENTSSL_CLIENTHELLO client offered bogus SNI" } else { log local0. "CLIENTSSL_CLIENTHELLO client offered this SNI: [string tolower $SNI] } }
This looks great Lucas. Line 6 is missing the close quote. To make it map fqdn's to virtuals, I assume it would look like this:
when CLIENTSSL_CLIENTHELLO priority 100 { if {[SSL::extensions exists -type 0]} { binary scan [SSL::extensions -type 0] @9a* SNI if {[regexp {(?i)[^a-z0-9.-]} $SNI]} { log local0. "CLIENTSSL_CLIENTHELLO client offered bogus SNI: $SNI" } elseif {[info exists SNI] && ($SNI equals "fqdn-a.com")} { virtual a #log local0. "CLIENTSSL_CLIENTHELLO client offered this SNI: [string tolower $SNI]" } elseif {[info exists SNI] && ($SNI equals "fqdn-b.com")} { virtual b #log local0. "CLIENTSSL_CLIENTHELLO client offered this SNI: [string tolower $SNI]" } } }
- seamlessfireworkAug 28, 2024Cirrostratus
Thanks a lot that worked great!
I added some (cosmetical) improvements. The irule VS code extension suggested to add "--" after the regexp because of argument injection. So I added it.
when CLIENTSSL_CLIENTHELLO priority 100 { if { [SSL::extensions exists -type 0] } { binary scan [SSL::extensions -type 0] @9a* client_sni if { [regexp -- {(?i)[^a-z0-9.-]} $client_sni] } { log local0. "CLIENTSSL_CLIENTHELLO client offered bogus SNI: $client_sni" } elseif { [info exists client_sni] && ($client_sni equals "fqdn-a.com") } { virtual a log local0. "CLIENTSSL_CLIENTHELLO client offered this SNI: [string tolower $client_sni]" } elseif { [info exists client_sni] && ($client_sni equals "fqdn-b.com") } { virtual b log local0. "CLIENTSSL_CLIENTHELLO client offered this SNI: [string tolower $client_sni]" } else { drop } } }
SNI-based routing is easy and efficient using local traffic policy. Why complicate using iRule? Please refer below article
- seamlessfireworkAug 26, 2024Cirrostratus
Thanks for your reply. Well, yes, traffic policies are easy in a way. On the other hand they feel not native to me in the BIG-IP ecosystem. I can't explain that exactly, it's very subjective. Also, configuring a traffic policy through REST is kind of complicated: create a draft, add the configuration, publish the policy. Changing an iRule is one single POST.