Forum Discussion
CraigM_17826
Altocumulus
AltocumulusServer ssl profile and pools issue
Hi all,
First up, apologies in advance for the long posting, but I wanted to give as much detail as possible.
This is the situation. I have been asked to make some changes to our BigIP so that when a user enters in a specific suffix on a URL that it will redirect them to another server, passing on the URI to that new server, but they want do not want the client to see the new URLs hostname, they want it to show our hostname, so it appears the content is running off our servers.
i.e. user enters www.acme.com/exams and in the backend the bigip connects to www.notacme.com/exams but the URL displayed in the clients browser shows www.acme.com/exams
So in this case a simple redirect would not work.
Now I have done this in the past using pools. I’m not really sure if this is the best or correct way of doing this, but I create a pool with member(s) that point to the backend servers hosting that content and then in an iRule check for specific text in the URI and if it matches I then tell it to use that pool. This has worked well and was quite a simple and quick to setup. So I thought it should ‘t be to hard to do for this new case.
Now the main difference I have is that the connection between the BigIP and this new server must be over SSL and that the server is using self signed certificates. Now I have managed to install the CA key for the keys on the BigIP and I have setup a serverssl profile using those keys. So far so good. I then changed the configuration of the virtual web server to use both the client and server SSL profiles. This is what now happens
1. If I try to access the site all the non SSL pool connections fail.
2. The one pool connection using SSL to the remote server works.
So it seems that setting the server SSL profile is a global in it’s scope. I thought there must be some way of telling the BigIP to use a specific server SSL profile for a specific pool. I did a search on the forums for this and I did come up with a hit or two which lead me to my current solutuin, and I must admit I don’t think it’s a particularyly good way although it works, so I would appreciate peoples thoughts on this and if there is a better way to do this.
So this is what I have currently done.
- On the configuration settings for the web server I have selected the server SSL Profile
- In the iRule, for every URI test I do that uses a POOL where connections to the members of those pools is not over ssl I have added a SSL::disable serverside directive.
- The block of code that tests for the exams in the URI just does a pool “pool name” so it inherits the virtual web server server ssl profile.
- At the end of the iRule I have a catch all that does a SSL::disable serverside followed by a pool “default pool”.
Now this does work, but as you can see it’s not exactly neat.
So although I have a solution, I would be interested to hear anyone else suggestions on how I should be doing this.
Thanks in advance,
Craig
hoolioCirrostratus
Hi Craig,
If you want to enable server SSL only for specific pools on a VIP, an iRule is necessary. It sounds like you have a solution which is working for you using SSL::disable. You can use SSL::profile PROFILE_NAME (Click here) to select a new SSL profile.
If you want more specific feedback on your iRule, can you post the code?
Thanks,
Aaron
CraigM_17826Hi Aaron,
I did notice the SSL::profile "profile_name", and correct me here if I am wrong, but I think it's only permissible within Server_Connected and to be honest I couldn't quite work out how I could use it there. All my pool selections are done within HTTP_RESPONSE and ideally it would have been nice if I could have used it there, but it was not to be.
Basically the iRule in question just does a lot of seperate URI checks for certain strings and depending on the what it finds it will use specific pools. Most of the other code in the iRule is for session persistance. The reason why there are more than one pools is that not all of the content is served by WebSphere, although it could be, but our internal developers haven't got round to it, so certain content comes from IIS servers to Tomcat servers. So it's a bit of a dogs breakfast. I'll post some code extracts tomorrow when I'm at work, but in a nutshell it's like this
if {[HTTP::URI] contains "/" }{
pool "PoolName"
return
}
I did think that I might have to go the route of using url re-writes but I thought using pools would be simpler for my situation.
Regards
Craig- hoolioI assume you mean HTTP_REQUEST for the pool selection? You could either add logic to HTTP_REQUEST to choose the correct profile name based on whatever criteria you need to (and then select the server SSL profile in SERVER_CONNECTED), or you could check which pool was selected in SERVER_CONNECTED and then specify which server SSL profile to use.
Aaron - CraigM_17826Hi Aaron,
ok, I've simplified it a bit now. The thing that threw me was that it seems that I have to have the server ssl profile defined in the properties of the virtal server or else the SSL::profile command seems to fail.
Here is what I ended up with
when HTTP_REQUEST {
if { [string tolower [HTTP::uri]] contains "/exam-services" } {
pool "ExamServices"
return 0
}
[other code]
when SERVER_CONNECTED {
if { [string tolower [LB::server pool]] eq "examservices" } {
SSL::profile "ExamSevices"
} else {
SSL::disable serverside
}
}
and this seems to work. Still unsure if this is best practice though.
Regards
Craig - hoolioHi Craig,
From reading the SSL::profile wiki page, I think you need to have a server SSL profile enabled in order to select a different server SSL profile. But I gather you can indeed select a different SSL profile than what's defined as the default server SSL profile. If you're only using one server SSL profile and want to selectively disable that profile, you should be able to just call SSL::enable/SSL::disable to do this (without bothering with SSL::profile).
Aaron