https to http redirect

Hi aschi,

 

 

You could solve your problem with httpclass Profiles or iRules, do you have a preference?

 

 

iRule Method:

 

On your HTTP Virtual Server, modify your HTTP to HTTPS Redirect iRule to look at the [HTTP::uri] before it takes any action. If "/uri1" redirect, if "/uri2" or "/uri3" send to the server pools for each.

 

 

On your HTTPS Virtual Server, apply the reverse logic of the previous iRule.

 

 

If you want to combine them into a single iRule you can do that as well using the "if {[TCP::local_port] == 443 }" approach and separate the logic. Also, make sure you have a default action (I assume that you would want the default action to perform an HTTP to HTTPS redirect to somewhere).

 

 

httpclass Method:

 

Each httpclass can match on the Host and/or URI Value. You can create the same type of logic used in the iRules to serve the same purpose.

 

 

httpclass1 = On HTTP Virtual Server detect "/uri1" and perform a redirect.

 

httpclass2 = On HTTPS Virtual Server detect "/uri2" and redirect to HTTP.

 

httpclass3 = On HTTPS Virtual Server detect "/uri3" and redirect to HTTP.

 

 

You could create a final httpclass to apply on your HTTP Virtual Server to perform a generic HTTP to HTTPS Redirect (just make sure it is the final httpclass in the stack (once an httpclass matches it will process the request and not process any further httpclasses).

 

 

Hope this helps.

hi Michael

 

Thanks for your explanations.

 

I tried it frist with the httpclass Method but it wasn't successfull. Not sure where the Problem was. Troubleshotting seems to me very difficult to find the Problem.

 

So I startet with iRules.

 

 

This works so far great but there one last Problem:

 

http://url/uri1 -> http://server1/uri1

 

https://url/uri1 -> https://server1/uri1

 

 

http://url/uri2 -> http://serverA/uri2 or http://serverB/uri2

 

https://url/uri2 -> http://serverA/uri2 or http://serverB/uri2

 

 

But the Problem is the from the Client side is must keep https. How do I terminate the https and go with http to the two Servers?

 

 

Terminating the ssl has to be done with the ssl Profile but how do I have to configure it that I am able to choss between http and http from the LTM to the webserver?

 

 

I used the following iRule for http Host:

 

when HTTP_REQUEST {

 

if { [HTTP::uri] starts_with "/uri2" } {

 

use pool ACA-Pool_NLB-Test_2Nodes_http

 

} else {

 

HTTP::redirect https://[HTTP::host][HTTP::uri] }

 

}

 

 

And for the https Host the following:

 

when HTTP_REQUEST {

 

if { [HTTP::uri] starts_with "/uri1" } {

 

use pool ACA-Pool_NLB-Test_https

 

} elseif { [HTTP::uri] starts_with "/uri2" } {

 

HTTP::redirect http://[HTTP::host][HTTP::uri]

 

use pool ACA-Pool_NLB-Test_2Nodes_http

 

} else {

 

use pool ACA-Pool_NLB-Test_2Nodes_https }

 

}

is it something like this?

 http virtual server

[root@ve10:Active] config  b virtual bar80 list
virtual bar80 {
   destination 172.28.19.252:80
   ip protocol 6
   rules https_redirect_rule
   profiles {
      http {}
      tcp {}
   }
}
[root@ve10:Active] config  b rule https_redirect_rule list
rule https_redirect_rule {
   when HTTP_REQUEST {
        HTTP::redirect "https://[HTTP::host][HTTP::uri]"
}
}

 https virtual server

[root@ve10:Active] config  b virtual bar443 list
virtual bar443 {
   snat automap
   destination 172.28.19.252:443
   ip protocol 6
   rules myrule
   profiles {
      clientssl {
         clientside
      }
      http {}
      serverssl {
         serverside
      }
      tcp {}
   }
}
[root@ve10:Active] config  b rule myrule list
rule myrule {
   when HTTP_REQUEST {
  set host [HTTP::host]
  set uri [HTTP::uri]
  switch [string tolower [HTTP::path]] {
    "/uri1" {
      pool server1
    }
    "/uri2" -
    "/uri3" {
      SSL::disable serverside
      pool server23
    }
    default {
       do something
    }
  }
}
when HTTP_RESPONSE {
  log local0. "conn [IP::client_addr]:[TCP::client_port] > [clientside {IP::local_addr}]:[clientside {TCP::local_port}] > [IP::remote_addr]:[TCP::remote_port] | host $host | uri $uri | pool [LB::server pool]"
}
}
[root@ve10:Active] config  b pool server1 list
pool server1 {
   members 200.200.200.101:443 {}
}
[root@ve10:Active] config  b pool server23 list
pool server23 {
   members {
      200.200.200.101:80 {}
      200.200.200.111:80 {}
   }
}

 test

[root@ve10:Active] config  cat /var/log/ltm
Mar  7 22:00:51 local/tmm info tmm[22185]: Rule myrule : conn 172.28.19.251:44555 > 172.28.19.252:443 > 200.200.200.101:443 | host 172.28.19.252 | uri /uri1 | pool server1
Mar  7 22:00:53 local/tmm info tmm[22185]: Rule myrule : conn 172.28.19.251:44556 > 172.28.19.252:443 > 200.200.200.101:80 | host 172.28.19.252 | uri /uri2 | pool server23
Mar  7 22:00:54 local/tmm info tmm[22185]: Rule myrule : conn 172.28.19.251:44557 > 172.28.19.252:443 > 200.200.200.111:80 | host 172.28.19.252 | uri /uri3 | pool server23

Hi

 

Thanks a lot, you saved my day.

 

At the end, with your help of course, it was very easy.

 

the Trick as you mentinod was: SSL::disable serverside

 

Best Regards,

 

Roger