Possible to selectively enable/disable SSL and HTTP profiles?

Hi,

 

 

I am attempting to selectively enable client-side SSL processing based on a condition - pool member availability in this case.

 

 

Normally the virtual server in question will perform no SSL processing, so no client-SSL profile is assigned by default (nor is an HTTP profile obviously). However, in the event that there are no pool members available, I need the VS to apply a client-SSL profile, complete an SSL handshake with the client, and return an HTTP redirect.

 

 

The problem is, that the LTM will not let me assign an iRule that employs the SSL::profile command unless an exising SSL profile is applied to the virtual server (same goes for HTTP:: commands). The error message is as follows:

 

 

BIGpipe: rule modification error:

 

01070394:3: SSL::profile in rule (pool_unavail_redirect_ssl) requires an associated SERVERSSL or CLIENTSSL profile on the virtual server (vs-test).

 

 

 

My iRule is as follows:

 

 

when CLIENT_ACCEPTED {

 

 

set mypool "some_pool"

 

set myredir "http://example.com/error.html"

 

 

if { [ active_members $mypool ] < 1 } {

 

 

SSL::profile clientssl

 

SSL::enable

 

HTTP::enable

 

 

}

 

 

}

 

 

when HTTP_REQUEST {

 

 

HTTP::redirect $myredir

 

 

}

 

 

 

Note that I have also tried assigning both a client-ssl profile and http profile, and then using an else statement in which I run SSL::disable and HTTP::disable. While I can successfully load this configuration, I cannot seem to get it to work.

 

 

Is this even possible, and if so, what am I missing? Is there a better way to do this?

 

 

Thanks in advance,

 

Nathan