Redirect to pool to bypass SSL offloading for Exchange Hybrid setup - syntax issue(s)

Hi, are you deploying all of your Exchange services on one virtual server? If so, you should be editing the combined iRule, not the redirect iRule. I would also think that since you deployed SSL offload, you don't have a server SSL profile assigned to your VIP so SSL::enable won't work. If you want to offload SSL, what you'll probably need to do is:

• Deploy the iApp using SSL bridging
• Disable strictness
• Create a new pool on port 443 for MRS proxy
• Modify your existing pools to use port 80
• Edit your combined pool iRule to look like the rule below.

Another option might be to point Office 365 to a different FQDN for migration, and do a separate, SSL bridging deployment at that IP address.

when HTTP_REQUEST {
 switch -glob -- [string tolower [HTTP::path]] {
      "/microsoft-server-activesync*" {
           TCP::idletime 1800
           SSL::disable
           pool /Common/exchange_2013.app/exchange_2013_as_pool3            
           CACHE::disable
           return
      }
      "/owa*" {
           if { [HTTP::header exists "Accept-Encoding"] } {
                HTTP::header remove "Accept-Encoding"
           }
           SSL::disable
           pool /Common/exchange_2013.app/exchange_2013_owa_pool3           
           return
      }
      "/ews/mrsproxy.svc"
      pool my_mrs_pool
      CACHE::disable
      return
 }
 "/ews*" {
      SSL::disable
      pool /Common/exchange_2013.app/exchange_2013_oa_pool3            
      CACHE::disable
      return
 }
 "/ecp*" {
      SSL::disable
      if { [HTTP::header exists "Accept-Encoding"] } {
           HTTP::header remove "Accept-Encoding"
      }
      pool /Common/exchange_2013.app/exchange_2013_owa_pool3            
      return
 }
 "/oab*" {
      SSL::disable
      pool /Common/exchange_2013.app/exchange_2013_oa_pool3
      persist none
      return
 }
 "/rpc/rpcproxy.dll*" {
      SSL::disable
      pool /Common/exchange_2013.app/exchange_2013_oa_pool3            
      CACHE::disable            
      return
 }
 "/autodiscover*" {
      SSL::disable
      pool /Common/exchange_2013.app/exchange_2013_ad_pool3
      persist none
      return
 }
 default {
       This final section takes all traffic that has not otherwise
       been accounted for and sends it to the pool for Outlook Web
       App
      SSL::disable
      pool /Common/exchange_2013.app/exchange_2013_owa_pool3

 }

} }

Thank you for your reply mikeshimkus!

You are correct about the iRule: it should be combined iRule.

Could I just insert this into the current combined iRule without reconfiguring the iApp?

      }
      "/ews/mrsproxy.svc"
      pool my_mrs_pool
      CACHE::disable
      return
 }

As you predicted the iApp currently is setup to 'SSL Offload' but looking at the clients CAS servers it's not enabled for EWS.

I don't understand-SSL offload is not enabled for EWS?

You can't simply add those lines to the iRule. The virtual server and pool members must be correctly configured to do server-side SSL.

Just wanted to add that it's possible to use a mixture of SSL Bridging and SSL Offloading using two Exchange iApps and an iRule with the "virtual" command. Maintain your original SSL Offload Exchange iApp and create a second iApp with a dummy VIP that does the reverse (converts exchange SSL 443 services to unencrypted port 80). Amazingly, the Exchange iApp supports this unusual "Reverse SSL Offloading" setup by allowing you to select "Unencrypted" and then "SSL-Bridging" deployment options. For Hybrid Exchange, you only need EWS and Autodiscover services exposed to port 80 on a dummy (unreachable) IP address. Now add an iRule to the original iApp that diverts all requests for "/EWS/mrsproxy.svc" to the virtual server created by the "Reverse SSL Offloading" iApp. This also allows you to easily configure a separate pool of servers for mailbox migration tasks. This was the simplest and most efficient technique I could find to support Hybrid Exchange.

This only becomes an issue for SSL Offload not SSL Bridging. We need to tell the F5 to use SSL on the backend between the F5 & cas servers for /ews/mrsproxy.svc. First create a pool that contains all the cas servers on port 443. Next modify the existing exchange https vip to include a server-ssl profile. Finally, modify the combined/pool selector rule as follows:

Code
when HTTP_REQUEST {
    SSL::disable serverside
    switch -glob -- [string tolower [HTTP::path]] {
        "/ews/mrsproxy.svc" {
             Exchange Web Services ==> use 443 cas server pool and enable server ssl for o365 mailbox moves.
            if { [HTTP::header exists "APM_session"] } {
                persist uie [HTTP::header "APM_session"] 7200
            } else {
                persist source_addr
            }
            pool /Common/Exch2010_ssl_pool
            SSL::enable serverside
        COMPRESS::disable
            CACHE::disable
            return
}

This iRule disables serverside SSL for all http requests, then selectively enables serverside SSL for requests to the URI: "/ews/mrsproxy.svc". It then selects the new ssl/443 pool created earlier.

Note: there will be some outage/impact for new connections between adding the serverside ssl profile & modifying the iRule to disable serverside ssl on all other connections.