SSL Offload and redirect pools

Forums Technical Forums
, , ,
1

Hi All,

I have the follow scenario and I would like know If there are one way to try to solve this using iRules.

The condition is…one VS that responds on https using ssl offload and I need to redirect some uri to another pool and other condiction is keep the ssl conection for other URI. All others can be use the default pool on HTTP port.

(Client) <--- HTTPS ----> (F5 SSL Offload) <--IF /siteA (HTTP) ----> Pool A (Server Side)

<--IF /siteB (HTTP) ----> Pool B (Server Side)

<--IF /siteC (HTTPS) ----> Pool B (Server Side)

Is it possible?

Thanks in advance!

Leonardo

2

You should be able to use iRules for this.

To confirm, siteB goes to Pool B:80 while siteC goes to Pool B:443?

3

Hi Chris,

It’s correct. Just to reminder the domain is the same: Ex. www.domain.com/siteA , www.domain.com/siteB and www.domain.com/siteC.

Thanks.

Leonardo

4

i did a bit testing. pls feel free to revise.

virtual bar {
   snat automap
   destination 172.28.17.55:https
   ip protocol tcp
   rules myrule
   profiles
      clientssl
      http
      serverssl
      tcp
}
pool poola {
   members 10.10.70.110:http
}
pool poolb {
   members 10.10.70.120:http
}
pool poolb_https {
   members 10.10.70.120:https
}
rule myrule {
   when HTTP_REQUEST {
        switch -glob [HTTP::uri] {
                "/siteA*" {
                        SSL::disable serverside
                        pool poola
                }
                "/siteB*" {
                        SSL::disable serverside
                        pool poolb
                }
                "/siteC*" {
                        pool poolb_https
                }
                default {
                         do something
                }
        }
}
}

just want to show connection could be established.

curl -Ik https://172.28.17.55/siteA
HTTP/1.1 404 Not Found
Date: Thu, 02 Dec 2010 04:46:55 GMT
Server: Apache/2.0.59 (rPath)
Vary: Accept-Encoding
Content-Type: text/html; charset=iso-8859-1

 curl -Ik https://172.28.17.55/siteB
HTTP/1.1 404 Not Found
Date: Thu, 02 Dec 2010 04:46:58 GMT
Server: Apache/2.0.59 (rPath)
Content-Type: text/html; charset=iso-8859-1

 curl -Ik https://172.28.17.55/siteC
HTTP/1.1 404 Not Found
Date: Thu, 02 Dec 2010 04:46:59 GMT
Server: Apache/2.0.59 (rPath)
Content-Type: text/html; charset=iso-8859-1
5

Thanks for doing the switch statement nitass!

Which is the better option? Enabling the Server SSL profile on the Virtual Server and disabling it where necessary via iRule, or not enabling it on the Virtual Server, and enabling it where necessary via iRule?

6

Chris / Nitass,

Thanks for your help!

I will do the test with my sites and I return to you the result!

Leonardo

7

As Chris said, you can use an iRule to selectively disable the server SSL profile. See the SSL::disable wiki page for an example:

http://devcentral.f5.com/wiki/default.aspx/iRules/ssl__disable

when HTTP_REQUEST {
  set usessl 0
  if { [string tolower [HTTP::uri]] starts_with "/secure" } {
    pool ssl__pool
    set usessl 1
  } else {
    pool static_pool
    set usessl 0
  }
}
when SERVER_CONNECTED {
  if { $usessl == 0 } {
    SSL::disable
  }
}

Aaron

8

Hi guys,

I have the same issue, my VS on 443 port and pools with 80 port. Can I use the same irule ?

9

I have the same issue, my VS on 443 port and pools with 80 port. Can I use the same irule ?

Daniel,

You don’t even need an iRule in this case. This is just a simple VIP listening on port 443, with a client SSL profile and a pool that points to servers on port 80. The client SSL profile decrypts the SSL on the client side, and the lack of a server SSL profile allows that traffic to flow unencrypted to the servers.

10

Ok, I got it, but I have different backend pools with http port, so I need to forward traffic based on URI to those pools. How can I do this with iRule?

11 
when HTTP_REQUEST {
    switch -glob [HTTP::uri] {
        "/foo*" { pool foo_pool }
        "/bar*" { pool bar_pool }
        "/blah*" { pool blah_pool }
        default { pool default_pool }
    }
}
12

Kevin,

But http_request is a client side event where is encrypted or just it’ll be executed after the certificate decrypt the packet?

13

If you have a client SSL profile applied to the VIP, traffic will be decrypted (OSI layer 6) and allow HTTP events to fire (layer 7).

14

Kevin,

it´s working with the irule you gave me, the only strange thing I´ve seen is I need to a / at end of uri or does not work.

Example: https://teste.domain.com/core/ (OK) https://teste.domain.com/core (Doesn´t work)

My servers are using http port and I saw the location field on HTTP response header like below and it´s right, is there a way to change this that you know ?

Location: "http://teste.domain.com/core/ Server: “Microsoft-IIS/8.5”

15

Did you use the -glob option? That allows you to add a wildcard to the end of the pattern, so

switch -glob [HTTP::uri] {
    "/core*" { pool core_pool }
}

should match “/core” and “/core/”, and “/core/foo”, etc.

16

Yes, I am using wildcard, but I’ve seen that without final slash the server respond http://teste.domain.com, the http header location field has this value and doesn’t connect.

17

I think you’re suggesting that traffic gets to the correct pool member, but that the server itself requires the trailing /.

Is that correct?