For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

zski128_101720's avatar
zski128_101720
Icon for Nimbostratus rankNimbostratus
Sep 17, 2010

No HTTP and HTTPs traffic over single VS?

Hello,   New to the forums. I am running 9.4.x and I am trying to setup a new virtual server listening on all ports (0). I have a pool of web servers assigned to this VS that are listening on bo...
config
design
L4L7_53191's avatar
L4L7_53191
Icon for Nimbostratus rankNimbostratus
Sep 19, 2010
Rich: I would absolutely create separate VIPs here, for a few reasons:

 

 

1) You need persistence, but the services are totally different (even if the app is the same HTTP is different from HTTPS). I'd setup a 80 and 443 vip, terminate ssl, etc.

 

2) It's more secure this way. Explicitly exposing services is better than a wildcard (port 0) VIP. A wildcard will forward any port back to your servers - not ideal unless you absolutely need to do this.

 

3) Since 80 and 443 are different services, different vips help you customize profile behavior for a specific service.

 

 

-Matt