For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Nathaneil0227_2's avatar
Nathaneil0227_2
Icon for Nimbostratus rankNimbostratus
Oct 26, 2016

LTM https/http issue

Hi All, We're having an issue with f5 this is the behaviour.   From https: When thr uset login the traffic became http and we are having the error. But when we type manually the https the page is...
application delivery
BIG-IP
devops
LTM
ekaleido_26616's avatar
ekaleido_26616
Icon for Cirrocumulus rankCirrocumulus
Oct 26, 2016

You need to create a virtual using the same IP, but using port 80 and apply an http profile to it. Then apply the iRule named "_sys_https_redirect" to the virtual.

 

All http traffic will now we redirected to https.

 

  • Nath's avatar
    Nath
    Icon for Cirrostratus rankCirrostratus
    Oct 27, 2016

    Hi ekal,

     

    Already did that, we have 3 VS VS:80 VS:443 VS:50443

     

    From Client -> VS:80 redirect -> VS:443 -> redirect -> 50443, website login page working. But once the user login the traffic became http.

     

  • ekaleido_26616's avatar
    ekaleido_26616
    Icon for Cirrocumulus rankCirrocumulus
    Oct 27, 2016

    Then the server(s) on the backend are doing the redirection.

     

  • Nath's avatar
    Nath
    Icon for Cirrostratus rankCirrostratus
    Oct 28, 2016

    Hi Ekal,

     

    How could we say that backend server is doing the http redirection? Even we have an SSL offloading at f5.

     

  • ekaleido_26616's avatar
    ekaleido_26616
    Icon for Cirrocumulus rankCirrocumulus
    Oct 28, 2016

    If traffic arrives at your backend server unencrypted, and depending how the application is written, it could be responding with code listing links as http:// It's not so much a redirect as just code stating to go there.

     

    As an example, if I click the login button on my site, the link is a POST to "/login" but I could just as easily make it a link to POST to ";

     

    Does that make sense?

     

  • Nath's avatar
    Nath
    Icon for Cirrostratus rankCirrostratus
    Oct 29, 2016

    Thanks for the effort Ekaleido. This proves that we need some adjustments to F5.

     

    Thanks a lot. Will keep this thread posted on the result.

     

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Oct 29, 2016

    Hi Nathaneil0227,

     

    I disagree when you say you need some adjustments to F5.

     

    most HTTP applications support a reverse proxy option to define what is the external URL to prevent URL rewriting on Reverse Proxy.

     

    if you solve it on the server, there is no CPU usage increase on server and F5.

     

    If you want to solve it on F5, it will increase CPU usage on F5 (one of my customers reduced to 10% of HTTP request per second when enabling rewriting. we solved it by changing server behavior)

     

  • Nath's avatar
    Nath
    Icon for Cirrostratus rankCirrostratus
    Oct 29, 2016

    Hi Stan,

     

    But one of the client requirement is to use F5 SSL built in chip, which makes less CPU load to backend servers.

     

    If you saw that Hem statement below, that is exactly the scenario we encountering right now. We don't need adjustment on the backend server that is why we have F5 I believe. F5 is very flexible appliance.

     

    Regards,

     

    Nathaneil