For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

keith_varga_107's avatar
keith_varga_107
Icon for Nimbostratus rankNimbostratus
Oct 30, 2015

irule to load to external Amazon machine and change domain name in address bar to match original request domain

We're running 11.6 Hotfix 3 on a active/standby physical F5 pair. We have this irule

when HTTP_REQUEST {
         HTTP::header insert "X_CLIENT_IP" [IP::client_addr]
         HTTP::header insert "X-Forwarded-For" [IP::client_addr]
         switch -glob [string tolower [HTTP::uri]] {
                 "*/pmcserver/checkforwork*" {
                          pool pm2_qa_web
                 }
                 "*pmcserver*" {
                          pool pm2_qa_pmcserver
                 }
                 "/partner*" { 
                          pool pm2_qa_soap 
                 }
                 "/eip*" { 
                          pool pm2_qa_eip_81
                 }
                 "/api*" {
                          reject
                          HTTP::respond 403 content "api requires https"  
                 }
                 "/home*" {
                          pool pm2_qa_aws
                 }
                 default {
                          pool pm2_qa_web 
                 }
         }
}

In the pm2_qa_aws pool, we have our external amazon machine defined as 52.32.9.136 (listens on port 80) Right now, the irule is not working at all (will not pass the http://52.32.9.136 amazon machine the traffic for some reason). You can hit this url to test it: http://preproto.printme.com/home

it should be taking the traffic to but instead just hangs. verified that the F5 can telnet to port 80 on 52.32.9.136 ok. i can also curl to http://52.32.9.136 from within a putty session on the F5 itself.

Can you help us figure out why the F5 will not pass the traffic to the amazon machine? Also, once we get that working to take traffic to is there a way to change the domain in the address bar back to http://preproto.printme.com/home?

Thanks much, Keith

1 Reply

  • We got things working by setting Source Address Translation to "AutoMap" on the port 80/443 F5 virtual servers.

     

    -Keith