For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

tororoy76_17327's avatar
tororoy76_17327
Icon for Nimbostratus rankNimbostratus
Dec 01, 2014

need help to modify header, stream irule

We have a problem right now, basically the client's application is load balanced through virtual server 10.4.2.106:443 and pool members 10.4.2.101:8888 and 10.4.2.102:8888

If you access https://10.4.2.106, it will show what is displayed on 10.4.2.101:8888 or 10.4.2.102:8888.

We access their application directly to the nodes through 10.4.2.101:8888/trips-gui/faces/login/Welcome.jspx and 10.4.2.102:8888/trips-gui/faces/login/Welcome.jspx. It will then redirect to:

or

For some reason, they cant change it. They want etis-app1-prod:8888 and etis-app2-prod:8888 to not show on the header. They want it replaced by https://etis.bir.gov.ph/ and without port.

So i made this iRule:

    when HTTP_REQUEST {

    STREAM::disable

    HTTP::header remove Accept-Encoding
    }
    when HTTP_RESPONSE {
    set internal_host "etis-app1-prod:8888" 
    set external_host "etis.bir.gov:8888"
    set internal_host2 "etis-app2-prod:8888"
    set external_host2 "etis.bir.gov:8888"

    if { [HTTP::header exists Location] }{ 
    HTTP::header replace Location [string map "$internal_host $external_host"                       [HTTP::header Location]] 
    } 

    if { [HTTP::header exists Location] }{ 
    HTTP::header replace Location [string map "$internal_host2 $external_host2"         [HTTP::header Location]] 
    } 

    if { [HTTP::header Content-Type] contains "text" } { 

    STREAM::expression "@$internal_host@$external_host@"

    STREAM::enable 
    } 
    }

after modifying the hosts file of the client, above irule will work:

etis.bir.gov.ph = 10.4.2.106 etis.bir.gov = 10.4.2.101 etis.bir.gov = 10.4.2.102

https://etis.bir.gov.ph/trips-gui/faces/login/Welcome.jspx will redirect to http://etis.bir.gov:8888/jsso/SSOLogin?appurl=http://etis-app1-prod:8888/trips-gui/faces/login/Welcome.jspx&appid=TRIPS-WEBetis-app1-prod8888

Their demands our: retain https://etis.bir.gov.ph/ on all connections, hide port 8888

What are the necessary configurations to meet our client's demand? We need your help.

No RepliesBe the first to reply