Using the F5 as a Reverse Proxy for RSA SecurID Self Service

In the meanwhile I found the issue. The Host-header don't need to be remove, but needs to be replaced with the FQDN of the server including its port.

I'm using now the following iRule:

when HTTP_REQUEST {
    if { not [class match [string tolower [HTTP::uri]] starts_with _allowed_uris] } {
        HTTP::respond 301 Location "https://[HTTP::host]/console-selfservice/"
    } else {
         Prevent the server from sending compressed responses as LTM does not decompress them 
        HTTP::header remove "Accept-Encoding" 
    }
}
when HTTP_REQUEST_SEND {
     Need to force the host header replacement and HTTP:: commands
     into the clientside context as the HTTP_REQUEST_SEND event
     is in the serverside context
    clientside {
         verify the selected server IP to specify its FQDN
        if { [IP::addr [LB::server addr] equals ] } {
            set server_hostname 
        } else {
            set server_hostname 
        }
        set server_port [LB::server port]
         Replace the host header value
        HTTP::header replace Host $server_hostname:$server_port
    }
}
when HTTP_RESPONSE {
    if { [HTTP::header exists Location] } {
        HTTP::header replace Location [string map -nocase {":7004" "" ":7004" ""} [HTTP::header Location]]
    }
}

Maybe this will help someone else as well.

Ciao Stefan 🙂