Multiple Websites on Single VIP

I would use two VIPs, one for HTTP and one for HTTPS. On the HTTP VIP you will want to create an iRule that redirects to HTTPS. You can use the built in iRule that exists for this, _sys_https_redirect or somthing like this if you want a 301 if you ever plan to use HSTS:

when HTTP_REQUEST {
set my_loc "https://[HTTP::host][HTTP::uri]"
TCP::respond "HTTP/1.1 301 Moved Permanently\r\nLocation: $my_loc\r\nConnection: close\r\nContent-Length: 0\r\n\r\n"
TCP::close
}

On the HTTPS VIP you will want to create a client SSL Profile for each site and use the "Server Name" field to enable SNI. With SNI you will need to create one of those profiles as the default for legacy clients, but you can also set the default profile to require SNI if you so desire.

I would use two VIPs, one for HTTP and one for HTTPS. On the HTTP VIP you will want to create an iRule that redirects to HTTPS. You can use the built in iRule that exists for this, _sys_https_redirect or somthing like this if you want a 301 if you ever plan to use HSTS:

when HTTP_REQUEST {
set my_loc "https://[HTTP::host][HTTP::uri]"
TCP::respond "HTTP/1.1 301 Moved Permanently\r\nLocation: $my_loc\r\nConnection: close\r\nContent-Length: 0\r\n\r\n"
TCP::close
}

On the HTTPS VIP you will want to create a client SSL Profile for each site and use the "Server Name" field to enable SNI. With SNI you will need to create one of those profiles as the default for legacy clients, but you can also set the default profile to require SNI if you so desire.

So the redirect sends you from HTTP to HTTPS correctly and you are presented a certificate. Does the certfiicate match what you would expect to be presented? i.e. https://site1.test.com/ is presented the certificate for site1.test.com?

Yesr SSL profile is applied.

But none of the site is opening. Just to know that i didnt recall any pool in the irule or anywhereelse in the config. HOw it will work ????

I just noticed you wanted to account for www in your HTTP-HTTPS redirect so here's an update example for that irule:

when HTTP_REQUEST {
    if {[string tolower [HTTP::host]] starts_with "www."}{
        set host [string range [HTTP::host] 4 end]
    }
    else {
        set host [HTTP::host]
    }
    set my_loc "https://$host[HTTP::uri]"
    TCP::respond "HTTP/1.1 301 Moved Permanently\r\nLocation: $my_loc\r\nConnection: close\r\nContent-Length: 0\r\n\r\n"
    TCP::close
}

The irule for the pool selection on your HTTPS VIP could look something like this:

when HTTP_REQUEST {
    switch [string tolower [HTTP::host]] {
        "site1.test.com" {
            pool site1_pool
        }
        "site2.test.com" {
            pool site2_pool
        }
        "site3.test.com" {
            pool site3_pool
        }
        default {
            pool default_pool
        }
    }
}

Hope this helps.

I just noticed you wanted to account for www in your HTTP-HTTPS redirect so here's an update example for that irule:

when HTTP_REQUEST {
    if {[string tolower [HTTP::host]] starts_with "www."}{
        set host [string range [HTTP::host] 4 end]
    }
    else {
        set host [HTTP::host]
    }
    set my_loc "https://$host[HTTP::uri]"
    TCP::respond "HTTP/1.1 301 Moved Permanently\r\nLocation: $my_loc\r\nConnection: close\r\nContent-Length: 0\r\n\r\n"
    TCP::close
}

The irule for the pool selection on your HTTPS VIP could look something like this:

when HTTP_REQUEST {
    switch [string tolower [HTTP::host]] {
        "site1.test.com" {
            pool site1_pool
        }
        "site2.test.com" {
            pool site2_pool
        }
        "site3.test.com" {
            pool site3_pool
        }
        default {
            pool default_pool
        }
    }
}

Hope this helps.

Hi,

I tried below config but no luck.

ltm virtual VS_RProxy_80 { description VS_RProxy_80 destination 192.168.216.33:http ip-protocol tcp mask 255.255.255.255 partition REVERSE_PROXY profiles { /Common/http { } /Common/tcp { } } rules { /Common/_sys_https_redirect } source 0.0.0.0/0 vlans { RPROXY_EXT_316 } vlans-enabled vs-index 244

ltm virtual VS_RProxy_443 {
description VS_RProxy_443
destination 192.168.216.33:https
ip-protocol tcp
mask 255.255.255.255
partition REVERSE_PROXY
persist {
    Reverse_Proxy_Persistence {
        default yes
    }
}
profiles {
    /Common/http { }
    /Common/tcp { }
    Reverse_Proxy_Cert {
        context clientside
    }
}
rules {
    TEST-1
    PROXY_TEST2
}
source 0.0.0.0/0
source-address-translation {
    type automap
}
vlans {
    RPROXY_EXT_316
}
vlans-enabled
vs-index 242

ltm rule TEST-1 {
partition REVERSE_PROXY
when HTTP_REQUEST {
switch [string tolower [HTTP::host]] {
    "enoclubricants.com" {
        pool ENOCLUBRICANTSPP1
    }
    "enocvettingsiredev.enoc.com" {
        pool ENOCVETTING
    }
    "wrench.enoc.com" {
        pool WRENCH_POOL
    }
    default {
         Use pool attached to virtual - no action required
    }
}


ltm rule PROXY_TEST2 {
partition REVERSE_PROXY
when HTTP_REQUEST {

set my_loc "https://[HTTP::host][HTTP::uri]" TCP::respond "HTTP/1.1 301 Moved Permanently\r\nLocation: $my_loc\r\nConnection: close\r\nContent-Length: 0\r\n\r\n" TCP::close }

But still not able to see any web page.

I tried below config but no luck.

can you try to remove PROXY_TEST2 irule from VS_RProxy_443 virtual server and see if it makes any different?

I have removed the irule only i have only one irule on the HTTPS VIP. but still the same.

when HTTP_REQUEST { switch [string tolower [HTTP::host]] { "enoclubricants.com" { pool ENOCLUBRICANTSPP1 } "enocvettingsiredev.enoc.com" { pool ENOCVETTING } "wrench.enoc.com" { pool WRENCH_POOL } default { Use pool attached to virtual - no action required } } }

can you add some logging?

e.g.

when HTTP_REQUEST { 
  log local0. "client=[IP::client_addr]:[TCP::client_port] host=[HTTP::host] uri=[HTTP::uri]"
  switch [string tolower [HTTP::host]] { 
    "enoclubricants.com" { pool ENOCLUBRICANTSPP1 } 
    "enocvettingsiredev.enoc.com" { pool ENOCVETTING } 
    "wrench.enoc.com" { pool WRENCH_POOL } 
    default { 
       Use pool attached to virtual - no action required 
    } 
  } 
}
when HTTP_RESPONSE {
  log local0. "client=[IP::client_addr]:[TCP::client_port] pool=[LB::server pool]"
}