I am having following requirement in which the servers in the pool should talk to the virtual server using HTTP only while all other users should redirect to HTTPS. The requirement for servers talking to the VS was fulfilled using the following iRule when CLIENT_ACCEPTED { checks to see if client_addr = any in the class fmw_nodes class has servers in the pool if { [matchclass [IP::client_addr] equals $::fmw_nodes]} { snat 192.168.253.250 } else { pool fwm-uat.bmc.com } } The HTTP -> HTTPS redirection is configured using following iRule when HTTP_REQUEST { HTTP::redirect https://[HTTP::host][HTTP::uri] } How does the iRule evaluation takes place when you have more than one iRules? I would appreciate any help in this regards. I am new to Big IP LTM Thanks in advance

Hi, iRules are processed in the order they have been set in the VS configuration. So if each iRule use the same variable, ensure you got the order correctly. Usually it's recommended if possible to merge several iRules in one. It's easier to troubleshoot and you can look at the code in one shot. If you are talking about the order of processing of your two iRules you configured above it will be: CLIENT_ACCEPTED then HTTP_REQUEST CLIENT_ACCEPTED is triggered after the TCP connection is established. HTTP_REQUEST will be triggered each time the client sends a request to the server. HTH N.

If you see the code i have used for SNAT it sends the traffic pool if the client ip doesnt match using the matchclass. If that is the case and assume i have 2 rules 1. SNAT 2. HTTP_Request, will it go to the second rule? Is it necessary to use "else" after "if"

Hi, Yes it will go to the HTTP_REQUEST anyway. What happens is: Your CLIENT_ACCEPTED event will say: when you'll forward the request hide the Source IP with this one. Then your HTTP_REQUEST will be trigger and it will redirect the user to HTTPS. In this case you didn't forward anything since you just send a redirect to the user so the snat request won't be effective and used. With both iRules, anyone talking through HTTP should be redirected through HTTPS. If you want not to redirect the servers you should merge everything in the HTTP_REQUEST to obtain something like this : when HTTP_REQUEST { if { [matchclass [IP::client_addr] equals $::fmw_nodes]} { snat 192.168.253.250 } else { if{ [TCP::local_port] == 80} } { HTTP::redirect https://[HTTP::host][HTTP::uri] } } } N.

when HTTP_REQUEST { if { [matchclass [IP::client_addr] equals $::fmw_nodes]} { snat 192.168.253.250 } else In the first part it should snat and send the traffic to pool also. Do i need to mention the pool statement or it will use the pool configured in Virtual Server?

if you don't use any pool command, it will use the default pool configured in the VS

Selective HTTPS redirection

23 Replies

Nicolas_Menant
Employee
Mar 03, 2008
You need a space between matchclass and [IP::client_addr]
Vishal_96707
Nimbostratus
Mar 03, 2008
Thanks. I fixed it. Now i am getting the webpage however it is not getting redirected to HTTPS my machine. My machine's ip is different that what is mentioned in "fmw_nodes". I am seeing my machines ip in the log.
Nicolas_Menant
Employee
Mar 03, 2008
Hmm,

Can you do the following?

when HTTP_REQUEST

{

log local0. "Client IP is: [IP::client_addr]"

if{[matchclass [IP::client_addr] equals $::fmw_nodes]}

{

log local0. "SNAT activated ..."

snat 192.168.253.250

}

else

{

log local0. "Redirecting ..."

HTTP::redirect https://[HTTP::host][HTTP::uri]

}

}

And please show us the log created this way.

It's in /var/log/ltm
Vishal_96707
Nimbostratus
Mar 03, 2008
The redirection is working however the server ip shown in logs is the snat ip. My machine ip is different 137.72.226.151

Mar 3 12:07:45 tmm tmm[1089]: Rule fmw-test2 : Redirecting ...

Mar 3 12:07:51 tmm tmm[1089]: Rule fmw-test2 : Client IP is: 192.168.253.250

Mar 3 12:07:51 tmm tmm[1089]: Rule fmw-test2 : Redirecting ...

Mar 3 12:07:55 tmm tmm[1089]: Rule fmw-test2 : Client IP is: 192.168.253.250

Mar 3 12:07:55 tmm tmm[1089]: Rule fmw-test2 : Redirecting ...

Mar 3 12:08:01 tmm tmm[1089]: Rule fmw-test2 : Client IP is: 192.168.253.250

Mar 3 12:08:01 tmm tmm[1089]: Rule fmw-test2 : Redirecting ...

Mar 3 12:08:05 tmm tmm[1089]: Rule fmw-test2 : Client IP is: 192.168.253.250

Mar 3 12:08:05 tmm tmm[1089]: Rule fmw-test2 : Redirecting ...
Vishal_96707
Nimbostratus
Mar 03, 2008
Please note that i want to snat the "fmw_nodes" and make sure that these nodes doesnt redirect to HTTPS. All other requests should redirect from http -> https.

Q. When the fmw_nodes condition matches in the first part then it doesnt fall through the "else" part right?
Nicolas_Menant
Employee
Mar 03, 2008
yes you're right about your question

In your iRule, use [IP::remote_addr] instead of [IP::client_addr]
Vishal_96707
Nimbostratus
Mar 03, 2008
Sorry i didnt get it. Where do you want me to use remote_addr? in the "if" condition?
Nicolas_Menant
Employee
Mar 03, 2008
yes replace [IP::client_addr] by [IP::remote_addr] everywhere
Vishal_96707
Nimbostratus
Mar 04, 2008
I have tried with remote_addr... Please find the below logs. Looks like the remote addr given is the ip address of the pool servers. I am trying from a machine which is having ip different than "fmw_nodes"... why is "if" condition i.e. snat taking place? My web browser is taking me to the https page.. is that something we can change in the iRule?

Mar 4 07:45:08 tmm tmm[1089]: Rule fmw-test3 : Client IP is: 192.168.253.110

Mar 4 07:45:08 tmm tmm[1089]: Rule fmw-test3 : SNAT activated ...

Mar 4 07:45:11 tmm tmm[1089]: Rule fmw-test3 : Client IP is: 192.168.253.111

Mar 4 07:45:11 tmm tmm[1089]: Rule fmw-test3 : SNAT activated ...

Mar 4 07:45:18 tmm tmm[1089]: Rule fmw-test3 : Client IP is: 192.168.253.110

Mar 4 07:45:18 tmm tmm[1089]: Rule fmw-test3 : SNAT activated ...

Mar 4 07:45:21 tmm tmm[1089]: Rule fmw-test3 : Client IP is: 192.168.253.111

Mar 4 07:45:21 tmm tmm[1089]: Rule fmw-test3 : SNAT activated ...

Mar 4 07:45:28 tmm tmm[1089]: Rule fmw-test3 : Client IP is: 192.168.253.110

Mar 4 07:45:28 tmm tmm[1089]: Rule fmw-test3 : SNAT activated ...

Mar 4 07:45:31 tmm tmm[1089]: Rule fmw-test3 : Client IP is: 192.168.253.111

Mar 4 07:45:31 tmm tmm[1089]: Rule fmw-test3 : SNAT activated ...

Mar 4 07:45:38 tmm tmm[1089]: Rule fmw-test3 : Client IP is: 192.168.253.110

Mar 4 07:45:38 tmm tmm[1089]: Rule fmw-test3 : SNAT activated
Nicolas_Menant
Employee
Mar 04, 2008
That's really strange it should be a client side context and then give you the IP address of the client ...

to force the BIGIP to give you the client ip address you can use this then

[clientside {IP::remote_addr}] instead of [IP::remote_addr].

but if 192.168.253.110 is not in your class and it activates SNAT it's weird Oo

if i have some time i'll check it in my lab

Forum Discussion

Selective HTTPS redirection

23 Replies

F5 Architecture Track Sessions - AppWorld 2026

Recent Discussions

Username is not filled in EdgeClient in the Modern customization

The GSLB pool is providing an incorrect IP to end users

iRule causing requests to be duplicated (sometimes)

F5 Networks F5CAB1 Exam - Need Help Regarding Prep

Cisco TACACS+ Config on ISE LTM Pair

Related Content

F5 HTTPS Redirect 2025

(HTTP) Redirection via Arbitrary Host Header

HTTP To HTTPS Redirect 301

How to achieve hiding internal URLs and HTTP dynamic redirection with F5 XC HTTP Load Balancer

Select pool based on HTTP host header

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS