SSL mutual authentication against the pool

The idea here is that all users will initially go to your "proxy-pass" application VIP, and as soon as someone requests "/GHI*", they'd get redirected to a second VIP that performs mutual authentication. You're just adding a separate VIP and separate client SSL profile, and probably a second DNS entry to point to this separate VIP.

I did make a typo in the last code example though. I added [string tolower ] in the switch condition, but didn't make the conditions lower case. Here's a better example:

when HTTP_REQUEST { 
    switch -glob [string tolower [HTTP::uri]] { 
        "/abc" { 
            pool ABC 
            HTTP::uri [string range [HTTP::uri] [string first "/" [HTTP::uri] 1] end] 
        } 
        "/def" { 
            pool DEF 
            HTTP::uri [string range [HTTP::uri] [string first "/" [HTTP::uri] 1] end] 
        } 
        "/ghi*" { 
            HTTP::redirect "https://mutual-auth-vip.domain.com"
        }
    }
}