IP to FQDN

No connection will work if I use the actual FQDN but fails if I use the ip and host command with HTTP/1.1 400 Bad Request.

 

 

This connection is not a standard HTTPS web site there is a client server service that will be running on both sides so replacing the ip address with the FQDN I believe is the only issue. Pool members are configured with service port 443 wouldn't that be the port I would want for the encryption?

So you could try configuring the VIP on port 80, the pool member(s) on port 443, and add the iRule. If you give that a go and it doesn't work, can you add logging to the iRule to make sure the Host header replacement is being done?

 

 

Aaron

ok, what would the logging look like?

 

Are you an F5 employee?

 

If so is there a secure location where I can share all the sensitive information?

 

 

Mike

 

Hi Mike,

No, I work for an F5 partner in the UK. If you want official F5 Support or consulting you can contact F5.

Can you try testing the VIP, pool and iRule? You could add logging like this:

 
 when HTTP_REQUEST { 
  
    log local0. "[IP::client_addr]:[TCP::client_port]: [HTTP::method] request to [HTTP::host][HTTP::uri]" 
  
     Check if Host header matches 1.1.1.1. 
     Use catch to handle non-IP Host values. 
     If IP::addr matches 1.1.1.1, $result will be 1 
    if {not ([catch {IP::addr [HTTP::host] equals 1.1.1.1} result]) && $result==1}{ 
  
       log local0. "[IP::client_addr]:[TCP::client_port]: Matched IP check for 1.1.1.1. Replacing host header" 
       HTTP::header replace Host "www.example.com" 
    } 
 } 
 when SERVER_CONNECTED { 
   log local0. "[IP::client_addr]:[TCP::client_port]: Connected to [IP::server_addr]:[TCP::server_port]" 
 } 
 

Aaron

OK, thanks, actually think I am getting better support from you!!

 

 

I will add this irule, give it a try, and let you know

 

 

 

Thanks again

 

 

Mike

Aaron,

 

Yea I know they sent me here.....

 

 

So I added the rule and am receiving the logs

 

Jan 28 13:48:15 tmm tmm[1616]: Rule Test_Log : 10.10.101.183:1461: Connected to 1.1.1.1:443

 

So I am guessing I have something wrong in my replacement rule

 

 

when HTTP_REQUEST {

 

 

 

 

Check if Host header matches 1.1.1.1.

 

 

Use catch to handle non-IP Host values.

 

 

If IP::addr matches 1.1.1.1, $result will be 1

 

 

if {not ([catch {IP::addr [HTTP::host] equals 1.1.1.1} result]) && $result==1}{

 

 

HTTP::header replace Host "example.com"

 

 

}

 

 

}

 

 

 

 

 

 

when HTTP_REQUEST {

 

 

log local0. "[IP::client_addr]:[TCP::client_port]: [HTTP::method] request to [HTTP::host][HTTP::uri]"

 

 

 

Check if Host header matches 1.1.1.1.

 

Use catch to handle non-IP Host values.

 

If IP::addr matches 1.1.1.1, $result will be 1

 

if {not ([catch {IP::addr [HTTP::host] equals 1.1.1.1} result]) && $result==1}{

 

 

log local0. "[IP::client_addr]:[TCP::client_port]: Matched IP check for 1.1.1.1. Replacing host header"

 

HTTP::header replace Host "example.com"

 

}

 

}

 

when SERVER_CONNECTED {

 

log local0. "[IP::client_addr]:[TCP::client_port]: Connected to [IP::server_addr]:[TCP::server_port]"

 

}

So that log line shows the connection being established with the server. Do you see a log line from these two previous log lines?

 

 

log local0. "[IP::client_addr]:[TCP::client_port]: [HTTP::method] request to [HTTP::host][HTTP::uri]"

 

log local0. "[IP::client_addr]:[TCP::client_port]: Matched IP check for 1.1.1.1. Replacing host header"

 

 

Aaron

Jan 28 13:58:50 tmm tmm[1616]: Rule Test_Log : 10.10.101.183:1688: Connected to 1.1.1.1:443

 

Jan 28 13:58:51 tmm tmm[1616]: Rule Test_Log : 10.10.101.183:1689: GET request to 2.2.2.2:1234/Example.svc?wsdl

 

Jan 28 13:58:51 tmm tmm[1616]: Rule Test_Log : 10.10.101.183:1689: Connected to 1.1.1.1:443

 

Jan 28 13:58:53 tmm tmm[1616]: Rule Test_Log : 10.10.101.183:1690: GET request to 2.2.2.2:1234/Example.svc?wsdl

 

Jan 28 13:58:53 tmm tmm[1616]: Rule Test_Log : 10.10.101.183:1690: Connected to 1.1.1.1:443

 

 

 

1.1.1.1 is external pool node address

 

2.2.2.2 is internal VIP address

 

Okay, so the iRule is looking for a request which contains the host header of 1.1.1.1. If the VIP is 2.2.2.2, then you can change the rule to check for 2.2.2.2. Or if you just want to rewrite the host header for all requests, you can remove the if check:

 
 when HTTP_REQUEST { 
     Replace the host header with www.example.com 
    HTTP::header replace Host "www.example.com" 
 } 
 

Aaron

Aaron,

 

Isn't the log catching both the 1.1.1.1 and 2.2.2.2 traffic now? the thing that is missing is the change from 1.1.1.1 to example. Or am I missing something?

 

 

 

Mike