Forum Discussion

bd94_306725's avatar
bd94_306725
Icon for Altostratus rankAltostratus
Mar 15, 2017

Virtual Server Destination address

Hi,

 

I'm new in the F5 administration and that's why my question seems to be stupid, but i'm lost and will need some clarification.

 

I would like to protect several of my applications associated with domain names, so i wanted to create several virtuals servers. A virtual server per domain name. However I encounter a problem when i try to use the same destination adress between different virtual server. I use Public IP, that's why I can't use a different one per virtual server.

 

What should i do ? Use Private IP for destination address on my virtual server ? But how people from the external can access ? Should I create a rewrite profil ? iApps with rewrite template ? iRules ?

 

Thanks for help me

 

application delivery
BIG-IP
security
  • crodriguez's avatar
    crodriguez
    Ret. Employee
    Mar 15, 2017

    You could use a single "external" (client-facing) virtual server that maps to your public IP address, and then use a local traffic policy on that virtual server to look at the domain name (host name) in the URL and forward the traffic to one of several "internal" virtual servers (on the same BIG-IP system) with private IP addresses. The "external" or main virtual server has no pool associated with it; just the local traffic policy (or iRule) that forwards the traffic to the correct "internal" virtual server based on host name. The "internal" virtual servers can each have their own protections, and load balance to their respective application pool members.

     

  • bd94_306725's avatar
    bd94_306725
    Icon for Altostratus rankAltostratus
    Mar 16, 2017

    Thank you very much for this clear and precise answer,

     

    Wich type of virtual server should i use ? Standard ? Forwarding (IP)?

     

    Best regards

     

  • crodriguez's avatar
    crodriguez
    Ret. Employee
    Mar 16, 2017

    A "Standard" host virtual server (as configured through the GUI) will work just fine. If the arriving traffic is encrypted, you'll have to terminate SSL for all the applications on the "external" VS so that the local traffic policy can examine the HTTP host header and forward the traffic to the appropriate "internal" VS.