iRule for custom traffic flow
Hi!
We currently have a setup where we have a HTTPS website which customers can upload both text and media (Sound or video) to a server and this data is stored in the cloud. This data is then passed onto another server on our premises for manual inspection.
I am looking to use our virtual F5 LTM (Which sits between the two above servers) to decrypt the HTTPS traffic and if it sees a file attachment pass the attachment off to one server and if it does not see any file attachment to then encrypt the data again and pass it to a different server.
I can decrypt the traffic no problems however I am a bit stuck with the traffic flow. I am lead to believe this is possible with an iRule, although I have no experience of these (Beyond reading what I have found on-line)
Is this possible with the F5 and can anyone point me in the right direction regarding the triggers I would potentially be using? Apologies for my lack of knowledge!
Many thanks Matt
Matt,
To perform this action, there are a couple things you need.
- Client-ssl and server-ssl profile on the virtual server.
- Identify requests with content.
Here is a simple example iRule that should accomplish what you need. I'm working under the assumption any POST will have content you want to inspect.
when HTTP_REQUEST { if {![info exists DEFAULT_POOL]} { set DEFAULT_POOL [LB::server pool] } set INSPECT 0 if {[HTTP::method] eq "POST"} { request should contain conent, select server the inspection pool pool inspection_servers set INSPECT 1 } else { pool $DEFAULT_POOL } } when SERVER_CONNECTED { do not encrypt server-side if destined to inspection pool if {$INSPECT} { SSL::disable } }
If you use a OneConnect profile, you should be able to remove the default pool selection as long as you're not running 11.5.3 HF2 or 12.0.0 - 12.0.0 HF3.
when HTTP_REQUEST { set INSPECT 0 if {[HTTP::method] eq "POST"} { request should contain conent, select server the inspection pool pool inspection_servers set INSPECT 1 } } when SERVER_CONNECTED { do not encrypt server-side if destined to inspection pool if {$INSPECT} { SSL::disable } }
As with anything, there is often more than one answer. Hopefully this will at least point you in the right direction.