Forum Discussion
Tika_92763
Jul 30, 2012Nimbostratus
Source IP restriction without HTTP profile
Hello,
I have to create a irule or find any other way.
Scenario, I am managing 2 Juniper SA 2500 (SSL VPN) devices in active/active clustering. Each client has their own sub-urls -- https://sslvpn.company.com/abc, https://sslvpn.company.com/xyz for clients abc and xyz respectively. They get thier own page for it. Cliets use windows terminal service and file sharing through ssl vpn. One of the client wants to restrict its url based on its source IP. I could not use x-Forwarded because SA devices does not work with http profile for terminal service and file sharing. How can I make a irule or any other way which restricts https://sslvpn.company.com/abc to the source ip? And, it should not affect other clients who use same virtual server but different urls. I am new to irule.
Thanks,
Tika
- natheCirrocumulusTika,
when CLIENT_ACCEPTED { if { [class match [IP::client_addr] not equals allowed_nets ] and [[HTTP::uri] starts_with "abc" ] } { reject } }
- Brian_Van_StoneNimbostratusWithout an http profile you will not be able to query the URI.
when CLIENT_ACCEPTED { if { [class match [IP::client_addr] equals allowed_nets] } { snatpool allowedForABC } else { snatpool everyoneElse }}
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects