Forum Discussion

Bartek's avatar
Bartek
Icon for Cirrus rankCirrus
Nov 05, 2019

IPP over HTTPS - how to accomodate http profile

Now this is a bugger - I do have a VIP used to relay traffic to a mobile printing gateway. The VIP needs to have an HTTP profile attached for two reasons:

1) I can inspect incoming traffic and only process allowed HTTP requests.

2) An iRule is set for logging and sending some formatted data to Splunk, so the infosec can further analyze it

If the profile is attached we experience the "pop up issue" - basically the traffic breaks, sadly I'm have not seen the tests myself and it is hard for me to explain exactly what is happening - I will try to provide more data once I get it. While the profile is detached the traffic works smoothly, but we allow every single HTTP request and the infosec is not happy...

 

So one of the tips I received is:

"Issue probably relates to the fact that the comms is actually ipp over http(port 443), so the profile is probably not expecting that, and stops comms. Can the profile be modified to allow this traffic?"

 

Did anyone eve experienced something similar? What should I adjust in the http profile to accommodate for ipp over https? As far as I understand ipp is Internet Printing Protocol...

 

Edit - so I have seen this error with my own eyes. The printjob goes throught, but the device from where it was requested gets a pop up error where it states, that there was an error. So it seems like some sort of confirmation message is not going back to the device through F5

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Nov 10, 2019

    the assumtion that doing none HTTP with a HTTP profile attach can cause issues seem logical to me.

     

    the workaround i can think of is to drop use HTTP events in the iRule and use TCP events. it is way less nice, but you are not doing HTTP in the first place, you are doing IPP.

     

    the long term alternative is asking F5 to support IPP.