Using the F5 as a Reverse Proxy for RSA SecurID Self Service

You can do this without proxypass using the following two irules.

If your environment is HA create a custom snat pool that uses only one of your floating IP addresses.

SNATs > SNAT Pool List > Create > Name it and add the single floating IP address... Add to your Virtual servers

Private https://HostName.Domain.com:7004/console-selfservice/

Public: https://rsa.website.com

Place this irule on your 7004 virutal server. It is necessary to listen on 7004 for the import-from-web function to continue working

when HTTP_REQUEST {

if { [string tolower [HTTP::uri]] contains ("/ctkip/services/") } {

HTTP::header replace "Host" internalhost.com:7004

} else {

HTTP::respond 200 content "RSA Self-Service Console - OLD

The URL for this site has changed. Please update your bookmark."

 

}

 

}

 

when HTTP_RESPONSE {

 

HTTP::header replace Location [string map -nocase {internalhost.com:7004 externalhost.com:7004} [HTTP::header value Location]]

 

}

 

 

 

This irule modifies the the uri so that visitors can type https://externalhost.com instead of https://externalhost.com/console-selfservice. Place this irule on your 443 and 7004 virtual servers

 

 

when HTTP_REQUEST {

 

if {[HTTP::uri] equals "/" } {

 

HTTP::uri /console-selfservice/

 

}

 

HTTP::header replace "Host" internalhost.com:7004

 

}

 

when HTTP_RESPONSE {

 

HTTP::header replace Location [string map -nocase {internalhost.com:7004 externalhost.com} [HTTP::header value Location]]

 

}