For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Qasim's avatar
Qasim
Icon for Cirrostratus rankCirrostratus
Jul 12, 2019
Solved

What LTM do to HTTP Header?

Hi,

 

I need to read up on LTMs as its a basic theory question but wondering if you can help me in the meanwhile:

my understanding is that LTM receives traffic on a particular VIP, replaces the header with the backend server name/IP and forwards it - am I correct?

 

if so, Anyway I can get LTM to keep the original header when forwarding to the pool members? its just that we have NGINX as a backend that is configured for header based routing.

 

Thanks in advance.

  • Lee_Sutcliffe's avatar
    Lee_Sutcliffe
    Jul 12, 2019

    It's not something that can be turned on with a check box, you need to either:

    • Use and iRule (one above is not re-writing the Host)
    • Use a Local Traffic Policy
    • Use an HTTP profile to erase a header

     

    Are you sure F5 is rewriting the Host? Can you share you VS config?

7 Replies

  • Lee_Sutcliffe's avatar
    Lee_Sutcliffe
    Icon for Nacreous rankNacreous
    Jul 12, 2019

    F5 will not re-write a Host header by default, you would need to configure it to do so.

    The default configuration would be

     

    Client ((Host header some.host.com) -> VIP -> Pool (Host header some.host.com)

     

    So in your example, NGINX could still do the header based routing

  • Qasim's avatar
    Qasim
    Icon for Cirrostratus rankCirrostratus
    Jul 12, 2019

    Thank Lee once again.

    if I was to enable the re-write, what would I need to do? is it like a checkbox somewhere? wondering if this has been enabled for a service I am t-shooting right now.

     the current IRULE only redirects so can't be the irule:

    when HTTP_REQUEST {

      switch -glob [HTTP::host] {

    uat-services-hccf.abc.co.uk { pool EXT_UAT_abc_443_POOL }

    thanks.

    • Lee_Sutcliffe's avatar
      Lee_Sutcliffe
      Icon for Nacreous rankNacreous
      Jul 12, 2019

      It's not something that can be turned on with a check box, you need to either:

      • Use and iRule (one above is not re-writing the Host)
      • Use a Local Traffic Policy
      • Use an HTTP profile to erase a header

       

      Are you sure F5 is rewriting the Host? Can you share you VS config?

      • Qasim's avatar
        Qasim
        Icon for Cirrostratus rankCirrostratus
        Jul 12, 2019

        I am not sure as I don;t have access to the logs but was just wondering whether that the case and if I can confirm it from the config.

         

        SO it won't replace the header even if offload SSL