I am trying to create an iRule that will force ssl on specific multiple URI’s under a specific host while letting those that do not need SSL to pass through. I am working on BIG-IP 9.4.7 Build 320.1
I have created a Virtual Server with port 80, created a pool and have added the iRule to the Virtual server. I have a wild card SSL cert that works for our appsf5.com
I have created the following iRule, but it only works once or twice before getting a page not found.
when HTTP_REQUEST
{ if { [HTTP::host] equals “appsf5.com” }{
if { [HTTP::uri] starts_with “/applications/app1” }
{ HTTP::redirect “https://[HTTP::host]/applications/app1/logon.aspx” }
elseif { [HTTP::uri] starts_with “/applications/app2” }
{ HTTP::redirect “https://[HTTP::host]/applications/app2/login.asp” }
elseif { [HTTP::uri] starts_with “/applications/app3” }
{ HTTP::redirect “https://[HTTP::host]/applications/app3/login.asp” }
elseif { [HTTP::uri] starts_with “/applications/app4” }
{ HTTP::redirect “https://[HTTP::host][HTTP::uri]” }
else {HTTP::respond “http://[HTTP::host][HTTP::uri]” }
}
}
Hi Deni,
The only command that looks unusually to me is the HTTP::respond line. I have never seen it used like that.
Did you mean HTTP::redirect?
Thanks,
Bhattman
I’m sorry, we actually used HTTP:Request. And we were able to make it consistently working by adding a host header to account for the IP being used for the VS for port 80 and 443.
Well, we thought we had it working. This is what the iRule actually says
when HTTP_REQUEST
{ if { [HTTP::host] equals “appsf5.com” }{
if { [HTTP::uri] starts_with “/applications/app1” }
{ HTTP::redirect “https://[HTTP::host]/applications/app1/logon.aspx” }
elseif { [HTTP::uri] starts_with “/applications/app2” }
{ HTTP::redirect “https://[HTTP::host]/applications/app2/login.asp” }
elseif { [HTTP::uri] starts_with “/applications/app3” }
{ HTTP::redirect “https://[HTTP::host]/applications/app3/login.asp” }
elseif { [HTTP::uri] starts_with “/applications/app4” }
{ HTTP::redirect “https://[HTTP::host][HTTP::uri]” }
else {HTTP::request}
}
}
It will either work if we use the applications that require SSL, but will not work if it should be a non-SSL application. We have tried making it a http:profile protocol, but with the specific pages we need to redirect to, this will not work.
We have also tried using HTTP::redirect “http://[HTTP::host][HTTP::uri]”, which also had mixed results. It would work sometimes and other times we receive a message, The page cannot be displayed
You have attempted to execute a CGI, ISAPI, or other executable program from a directory that does not allow programs to be executed.
So you’re looking to redirect based on the URI ? Something like this perhaps?
when HTTP_REQUEST {
if { [HTTP::host] equals "appsf5.com" } {
switch [string tolower [HTTP::uri]] {
"/applications/app1*" {
HTTP::redirect "https://[HTTP::host]/applications/app1/logon.aspx"
}
"/applications/app2*" {
HTTP::redirect "https://[HTTP::host]/applications/app2/login.asp"
}
"/applications/app3*" {
HTTP::redirect "https://[HTTP::host]/applications/app3/login.asp"
}
"/applications/app4*" {
HTTP::redirect "https://[HTTP::host][HTTP::uri]"
}
}
}
}
I’m not sure I follow what you were trying to do with the else {HTTP::request} bit. What was that put in to accomplish?
Colin
If we only put in the redirects to https: the applications that are not https display a page cannot be displayed error. So yes, we are trying to do a redirect based on URI for those applications that need to be https and let those that are http: just be ignored by the iRule.
Posted By deni on 01/05/2011 11:15 AM
If we only put in the redirects to https: the applications that are not https display a page cannot be displayed error. So yes, we are trying to do a redirect based on URI for those applications that need to be https and let those that are http: just be ignored by the iRule.
Colin’s rule (above) will only redirect the users to HTTPS if their requested host name is “appsf5.com” and their URI starts with /app1, /app2, /app3, or /app4. That’s all you’re looking for, right?
That is what I am looking for. I have applied this rule. At the moment it is working. But I will test again in an hour or so. We have had the rule work one time and the next time we tested, only half worked and another time none worked.
I will post again after further testing.
The rule does not work as expected. If I use https://appsf5.com/applications/app1/logon.asp it does work. If I try http://appsf5.com/applications/app1/logon.asp, it does not redirect me to the https address.
Posted By deni on 01/06/2011 08:21 AM
The rule does not work as expected. If I use https://appsf5.com/applications/app1/logon.asp it does work. If I try http://appsf5.com/applications/app1/logon.asp, it does not redirect me to the https address.
Did you apply it to the Virtual Server listening on port 80 or just the one listening on 443? It should be applied to the one on port 80. That’s the only thing I could see being a problem.
It is applied only on the Virtual Server listening on port 80.
Let’s add some logging then.
when HTTP_REQUEST {
if { [HTTP::host] equals "appsf5.com" } {
switch [string tolower [HTTP::uri]] {
"/applications/app1*" {
HTTP::redirect "https://[HTTP::host]/applications/app1/logon.aspx"
log local0. "Requested http://[HTTP::host][HTTP::uri] and was redirected to https://[HTTP::host]/applications/app1/logon.aspx"
}
"/applications/app2*" {
HTTP::redirect "https://[HTTP::host]/applications/app2/login.asp"
log local0. "Requested http://[HTTP::host][HTTP::uri] and was redirected to https://[HTTP::host]/applications/app2/login.asp"
}
"/applications/app3*" {
HTTP::redirect "https://[HTTP::host]/applications/app3/login.asp"
log local0. "Requested http://[HTTP::host][HTTP::uri] and was redirected to https://[HTTP::host]/applications/app3/login.asp"
}
"/applications/app4*" {
HTTP::redirect "https://[HTTP::host][HTTP::uri]"
log local0. "Requested http://[HTTP::host][HTTP::uri] and was redirected to https://[HTTP::host][HTTP::uri]"
}
}
}
}
Try again and it should log to the LTM section of logs when a redirect is triggered.
I have added the logging. I am unable to find the logs it creates. It still does not redirect correctly. Could you explain how I find the log files?
If using the GUI, they’ll be under system > logs > ltm
I am working on BIG-IP 9.4.7 Build 320.1 I am using the GUI. Under System > Logs > I have the choices of System, Packet Filter, Local Traffic, Audit, Application Security and Options.
I chose Local Traffic and there is a list there, but it is just a list and all it has is (I changed the IP address)
Thu Jan 6 09:05:21 CST 2011 F5Name-DMZ-1 bigpipe Completed config sync all operation
Thu Jan 6 09:58:22 CST 2011 F5Name-DMZ-1 mcpd[2458] 01070638 Pool member 111.111.111.11:80 monitor status down.
Thu Jan 6 09:58:22 CST 2011 tmm tmm[2048] 01010028 No members available for pool SDBoardOfNursing_pool
Thu Jan 6 09:58:51 CST 2011 F5Name-DMZ-1 mcpd[2458] 01070727 Pool member 111.111.111.11:80 monitor status up.
Thu Jan 6 12:40:22 CST 2011 F5Name-DMZ-1 bigpipe Completed config sync all operation
Thu Jan 6 12:49:32 CST 2011 F5Name-DMZ-1 bigpipe Completed config sync all operation
Thu Jan 6 12:50:08 CST 2011 F5Name-DMZ-1 bigpipe Completed config sync all operation
Thu Jan 6 12:50:43 CST 2011 F5Name-DMZ-1 bigpipe Completed config sync all operation
Thu Jan 6 13:03:18 CST 2011 F5Name-DMZ-1 bigpipe Completed config sync all operation
Is there some setting in options that I need to set?
Local Traffic is indeed the right section.
If this iRule is applied, there’s no reason it shouldn’t be getting hit and logging messages. Can you describe the steps by which you applied the rule? And also the exact link you’re using?
I have a Virtual Server set at Port 80. On that Virtual Server, I have applied the iRule by clicking on the Virtual Server in the F5 GUI interface and selecting Resources. In the IRules section, I clicked Manage and added the iRule. I moved this iRule to the top of the list.
Good…that’s definitely proper.
I’m adding another log statement that should log every single HTTP Request so kindly check the logs again after hitting the Virtual Server with the following rule.
when HTTP_REQUEST {
log local0. "User went to http://[HTTP::host][HTTP::uri]"
if { [HTTP::host] equals "appsf5.com" } {
switch [string tolower [HTTP::uri]] {
"/applications/app1*" {
HTTP::redirect "https://[HTTP::host]/applications/app1/logon.aspx"
log local0. "Requested http://[HTTP::host][HTTP::uri] and was redirected to https://[HTTP::host]/applications/app1/logon.aspx"
}
"/applications/app2*" {
HTTP::redirect "https://[HTTP::host]/applications/app2/login.asp"
log local0. "Requested http://[HTTP::host][HTTP::uri] and was redirected to https://[HTTP::host]/applications/app2/login.asp"
}
"/applications/app3*" {
HTTP::redirect "https://[HTTP::host]/applications/app3/login.asp"
log local0. "Requested http://[HTTP::host][HTTP::uri] and was redirected to https://[HTTP::host]/applications/app3/login.asp"
}
"/applications/app4*" {
HTTP::redirect "https://[HTTP::host][HTTP::uri]"
log local0. "Requested http://[HTTP::host][HTTP::uri] and was redirected to https://[HTTP::host][HTTP::uri]"
}
}
}
It now logs the first logging “User went to http://[HTTP::host][HTTP::uri]” but does not make it to the logging within each application. So it doesn’t seem to be hitting the
switch [string tolower [HTTP::uri]] {
“/applications/app1*”
{ HTTP::redirect “https://[HTTP::host]/applications/app1/logon.aspx”
log local0. “Requested http://[HTTP::host][HTTP::uri] and was redirected to https://[HTTP::host]/applications/app1/logon.aspx” }
I have used iRule Editor and the syntax shows it as correct, but it does not show the log local0. “Requested http://[HTTP::host][HTTP::uri] and was redirected to https://[HTTP::host]/applications/app1/logon.aspx” } in the log.
What was the log message when it hit “User went to http://[HTTP::host][HTTP::uri]”?