Forum Discussion

Nimbostratus

Mar 20, 2017

iRule for custom traffic flow

Hi!

We currently have a setup where we have a HTTPS website which customers can upload both text and media (Sound or video) to a server and this data is stored in the cloud. This data is then passed onto another server on our premises for manual inspection.

I am looking to use our virtual F5 LTM (Which sits between the two above servers) to decrypt the HTTPS traffic and if it sees a file attachment pass the attachment off to one server and if it does not see any file attachment to then encrypt the data again and pass it to a different server.

I can decrypt the traffic no problems however I am a bit stuck with the traffic flow. I am lead to believe this is possible with an iRule, although I have no experience of these (Beyond reading what I have found on-line)

Is this possible with the F5 and can anyone point me in the right direction regarding the triggers I would potentially be using? Apologies for my lack of knowledge!

Many thanks Matt

Matt,

To perform this action, there are a couple things you need.

Client-ssl and server-ssl profile on the virtual server.
Identify requests with content.

Here is a simple example iRule that should accomplish what you need. I'm working under the assumption any POST will have content you want to inspect.

when HTTP_REQUEST {
    if {![info exists DEFAULT_POOL]} { set DEFAULT_POOL [LB::server pool] }

    set INSPECT 0
    if {[HTTP::method] eq "POST"} {
         request should contain conent, select server the inspection pool
        pool inspection_servers
        set INSPECT 1
    } else {
        pool $DEFAULT_POOL
    }
}
when SERVER_CONNECTED {
     do not encrypt server-side if destined to inspection pool
    if {$INSPECT} { SSL::disable }
}

If you use a OneConnect profile, you should be able to remove the default pool selection as long as you're not running 11.5.3 HF2 or 12.0.0 - 12.0.0 HF3.

when HTTP_REQUEST {
    set INSPECT 0
    if {[HTTP::method] eq "POST"} {
         request should contain conent, select server the inspection pool
        pool inspection_servers
        set INSPECT 1
    }
}
when SERVER_CONNECTED {
     do not encrypt server-side if destined to inspection pool
    if {$INSPECT} { SSL::disable }
}

As with anything, there is often more than one answer. Hopefully this will at least point you in the right direction.

Jeremy_Church_3
Cirrus
Mar 20, 2017
Matt,

To perform this action, there are a couple things you need.

Client-ssl and server-ssl profile on the virtual server.
Identify requests with content.

Here is a simple example iRule that should accomplish what you need. I'm working under the assumption any POST will have content you want to inspect.

when HTTP_REQUEST { if {![info exists DEFAULT_POOL]} { set DEFAULT_POOL [LB::server pool] } set INSPECT 0 if {[HTTP::method] eq "POST"} { request should contain conent, select server the inspection pool pool inspection_servers set INSPECT 1 } else { pool $DEFAULT_POOL } } when SERVER_CONNECTED { do not encrypt server-side if destined to inspection pool if {$INSPECT} { SSL::disable } }

If you use a OneConnect profile, you should be able to remove the default pool selection as long as you're not running 11.5.3 HF2 or 12.0.0 - 12.0.0 HF3.

when HTTP_REQUEST { set INSPECT 0 if {[HTTP::method] eq "POST"} { request should contain conent, select server the inspection pool pool inspection_servers set INSPECT 1 } } when SERVER_CONNECTED { do not encrypt server-side if destined to inspection pool if {$INSPECT} { SSL::disable } }

As with anything, there is often more than one answer. Hopefully this will at least point you in the right direction.
- MatthewStyles_3
  Nimbostratus
  Mar 20, 2017
  Hi Jeremy!
  
  Wow! Thank you for the quick response! As I understand it, the http POST method is used when uploading a file to a server, however in our instance, the upload has already been completed to our internet server, and it is this server that is then transferring the data via HTTPS to our internal server via the F5 in question, so I don't think the F5 would see a HTTP POST request? I may be wrong, my understanding of HTTP processes is limited!
  
  Many thanks Matt
- Jeremy_Church_3
  Cirrus
  Mar 20, 2017
  Matt,
  
  It is quite possible I did not understand your original question. Here is my interpretation.
  
  Current configuration:
  File transferred from client to server_1 via HTTPS and F5 virtual server.
  File transferred from server_1 to server_2 via HTTPS and F5 virtual server.
  Desired configuration:
  File transferred from client to server_1 via HTTPS and F5 virtual server.
  File transferred from server_1 via HTTPS and F5 virtual server to:
  
  a. server_2 via HTTPS if there is no attachment.
  
  b. server_3 via HTTP if there is an attachment.
  
  Is this correct? Are there any additional steps or something else missing?
  
  In step 2, if an HTTP(S) transfer is initiated from server_1 to server_2, server_1 is acting as an HTTP client.
- MatthewStyles_3
  Nimbostratus
  Mar 27, 2017
  Hi Jeremy,
  
  Apologies for the wait, over the last week we've had a redesign of the application which now means that my original question no-longer applies to our situation. I didn't want to be one of those guys that never come back after an answer is given and so I just wanted to say thank you for helping me out, it really is very much appreciated.
  
  iRules are definitely something I will need to understand further and your answer was a very good start in helping me understand how they operate.
  
  Thanks again Matt