Forum Discussion
AltostratusVIP using two different URL and certificates
MVPHi Thiago,
I understand that you have one external hostname for your app and one internal. In your example url1.domain.com for external and url2.domain.com for internal.
And that you have different paths for internal and external. External might be /dirA/index.html, while internal might be /dirB/index.html.
So for users accessing the app via url1.domain.com you want to rewrite the HTTP::host and (partially) the HTTP:path so that they match the internal ones, right? That can be done with iRules or with LTM Traffic Policies. I find this picture handy to learn the terminology.
For the SSL bridging, 90% of the cases can be satisfied with the default serverssl profile, it is sufficient to establish a connection to a pool member using https. Unless you have requirements on the serverside, like SNI or SSL protocol, this serverssl profile will do.
Best of luck
Daniel
Thiago_MoraisHi Daniel,
Thank you for your reply.
I got more details about the request that the application will handle.
External URL: https://url1.domain.com:10002/coreService/services
Internal URL: https://url2.domain.com:10002/coreService/services
In that case, I am thinking to use an iRule to rewrite the HTTP::host from url1.domain.com to url2.domain.com in the HTTP_REQUEST and HTTP_RESPONSE?
What do you think about it?
Regards,
TM
- Daniel_Wolf
Hi Thiago,
I would use a LTM Traffic Policy instead on an iRule and also I would pay attention if maybe you want to rewrite the Referer header too.
In a Traffic Policy you would do it like this (tmsh output)
ltm policy policy_route_url1.domain.com { controls { forwarding server-ssl } requires { http } rules { match_url1.domain.com { actions { 0 { http-host replace value url2.domain.com } 1 { http-referer replace value "tcl:[regsub -nocase {url1.domain.com} [HTTP::header Referer] {url2.domain.com}]" } 2 { forward select pool pool_url2.domain.com } } conditions { 0 { http-host host values { url1.domain.com } } } } status published strategy first-match }KR
Daniel
- Thiago_Morais
Thanks, Daniel
The configuration is ready to be applied in the F5, after that, I'll let you know.
- Thiago_Morais
Hi Daniel
I don't know how, but the external application gets access to the internal application through the Virtual Server, but I don't have to configure police or iRule. The Virtual Server was configured to Standard type, SSL Client Profile was configured to use the external certificate, and SSL Server Profile was configured to use the internal certificate. When I applied all configurations in the F5, in the first test, the access was done successfully.
