Forum Discussion

mc_344761's avatar
mc_344761
Icon for Nimbostratus rankNimbostratus
Jan 02, 2018

reverse proxy

Hi All,   We are going to use BIG-IP mainly as a reverse proxy.   A test scenario (see attached drawing) is that a user on Internet (client side) will access 2 web services running on 2 interna...
application delivery
BIG-IP
devops
LTM
Srini_87152's avatar
Srini_87152
Icon for Cirrostratus rankCirrostratus

hi,

 

you can create two pools, pool_pool1 with node1 server and pool_pool2 with node 2 server. Assign default pool with pool_pool1 at vip level and create following irule assign to vip

 

So any traffic coming on https://test.com/ it connect to pool_pool1 and /slae will connect to pool_pool2

 

Thx

 

Srini

 

=========================================================

 

when HTTP_REQUEST { switch -glob [string tolower [HTTP::path]] { "/sale" { pool pool_pool2 } default { drop } } }

 

=========================================

 

mc_344761's avatar
mc_344761
Icon for Nimbostratus rankNimbostratus
Jan 03, 2018

Thanks again Srini,

 

As you pointed, I have now created 2 pools (one pool for each server).

 

Tried both suggested by you iRule (I must refresh my coding knowledge :)) and other solution based on policy and rewrite profile (see furhter down). None of them worked out yet but im still testing.

 

And still some issues:

 

  • request from internet to VS comes as https://test.com
    • Client SSL profile was created and linked to VS on Client side
  • request from VS to server must have a format of test.exe (including test.exe part)
    • so I believe my iRule will have to include that change in URL (in addition to redirecting traffic to a proper pool) - or is there other way of fixing it? should I mix with rewrite profile or better include everything in the iRule?
  • in addition https between VS and server is using another SSL profile (other certificate)
    • when I tested it towards only one pool I managed to access a webpage but it was presented as a simple text - looks like there are some issues With java scripts... Wonder if it could have anything to do with the fact of using different SSL profiles on client and server side

I found this article about setting up BIG-IP as a reverse proxy with use of policy and rewrite profile:

 

https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-implementations-11-4-0/21.html

 

Using rewrite profile takes care of URL change and a policy of redirecting traffic to a proper pool. I tested it but policy didn't work for me - all requests are forwardedd to the same pool :/

 

Anyway - appreciate your help. Do you know if using 2 SSL profiles (with different certificates) for internal and external side of BIG-IP might be a problem in my case?

 

Thanks again

 

mc