Forum Discussion
Tika_92763
Nimbostratus
NimbostratusSource IP restriction without HTTP profile
Hello,
I have to create a irule or find any other way.
Scenario, I am managing 2 Juniper SA 2500 (SSL VPN) devices in active/active clustering. Each client has their own sub-urls ...
Brian_Van_StoneNimbostratus
NimbostratusWithout an http profile you will not be able to query the URI.
Perhaps you can SNAT all requests from the restricted range to one SNAT pool, and all requests from the unrestricted range to a different SNAT pool. By doing this you could still perform IP restriction at the SA.
when CLIENT_ACCEPTED { if { [class match [IP::client_addr] equals allowed_nets] } { snatpool allowedForABC } else { snatpool everyoneElse }}