Forum Discussion
Nathan_McKay_67
Nimbostratus
Jan 03, 2007Possible to selectively enable/disable SSL and HTTP profiles?
Hi,
I am attempting to selectively enable client-side SSL processing based on a condition - pool member availability in this case.
Normally the virtual server in question will perf...
Nathan_McKay_67
Nimbostratus
Jan 05, 2007Thanks for the reply. Yes I am trying to decrypt the HTTPS traffic and send a redirect if the pool is down but otherwise leave it alone and LB the connection as is. I was able to get your suggested rule to work with a little tweaking:
when RULE_INIT {
set mypool "some_pool"
set myredir "http://example.com/error.html"
}
when CLIENT_ACCEPTED {
global mypool
if { [active_members $mypool] > 0 } {
SSL::disable
HTTP::disable
pool $mypool
}
}
when HTTP_REQUEST {
global myredir
HTTP::redirect $myredir
}
So while that works, I am concerned that it will cause what would otherwise be unnecessary load on the LTM units. In practice, the pool should almost never be unavailable, but I would like to employ this redirect as a failsafe (and customer-service) mechanism.
Ideally I would not have to instruct the LTM to disable the profiles since that is going to be executed for every connection. Whereas if I could instruct the LTM to enable a profile dynamically, I could avoid this extra processing to accommodate a scenario which is (hopefully) unlikely to occur on any kind of regular basis.
It may turn out that the overhead is negligible, but I would like to keep it to a minimum wherever possible.
Thanks again for your feedback.
- Nathan
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects