For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

mbayer_236661's avatar
mbayer_236661
Icon for Nimbostratus rankNimbostratus
Dec 07, 2015

HTTP going to Pool81 and everything else going to HTTPS on elsePool on Same VIP

I have an application that will need to resolve to the same DNS/VIP -- I would like to have HTTP on say /status route to an Apache listing on port81, and everything else coming in on that same VIP IP...
application delivery
BIG-IP
iRules
StephanManthey's avatar
StephanManthey
Icon for Nacreous rankNacreous
Dec 07, 2015

Hi,

 

I am not sure to get your question right.

 

Is the traffic received on different TCP ports or do you expect it all encrypted on the same virtual IP and port 443?

 

Will the clients use the same hostname or will it be different hostnames? In case of different hostnames (especially if you are using different 2nd and top level domains) you would use the so called server name indication (aka SNI).

 

Multiple client-ssl profiles with hostname specific certificate/key pairs would be required and bound to the virtual server.

 

Based on hostname you can decide by iRule to forward cleartext http to a specific pool (by disabling server-ssl) or to re-encrypt and to forward to another server pool.

 

Thanks, Stephan