# SSL Offload and redirect pools

**URL:** <https://community.f5.com/t/ssl-offload-and-redirect-pools/38147>\
**Category:** Technical Forums\
**Tags:** irules, dev, devops, application-delivery\
**Created:** [December 1, 2010, 11:21am UTC](https://community.f5.com/t/ssl-offload-and-redirect-pools/38147 "2010-12-01T11:21:31Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![lmalafati\_54233](https://avatars.discourse-cdn.com/v4/letter/l/4bbf92/32.png) [@lmalafati\_54233](https://community.f5.com/u/lmalafati_54233)\
**Post date:** [December 1, 2010, 11:21am UTC](https://community.f5.com/t/ssl-offload-and-redirect-pools/38147/1 "2010-12-01T11:21:31Z")

</div>

Hi All,

I have the follow scenario and I would like know If there are one way to try to solve this using iRules.

The condition is…one VS that responds on https using ssl offload and I need to redirect some uri to another pool and other condiction is keep the ssl conection for other URI. All others can be use the default pool on HTTP port.

(Client) \<--- HTTPS ----\> (F5 SSL Offload) \<--IF /siteA (HTTP) ----\> Pool A (Server Side)

\<--IF /siteB (HTTP) ----\> Pool B (Server Side)

\<--IF /siteC (HTTPS) ----\> Pool B (Server Side)

Is it possible?

Thanks in advance!

Leonardo

---

<div class="post-metadata">

**Author:** ![Chris\_Miller](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/chris_miller/32/14702_2.png) [@Chris\_Miller](https://community.f5.com/u/Chris_Miller)\
**Post date:** [December 1, 2010, 2:13pm UTC](https://community.f5.com/t/ssl-offload-and-redirect-pools/38147/2 "2010-12-01T14:13:17Z")

</div>

You should be able to use iRules for this.

To confirm, siteB goes to Pool B:80 while siteC goes to Pool B:443?

---

<div class="post-metadata">

**Author:** ![lmalafati\_54233](https://avatars.discourse-cdn.com/v4/letter/l/4bbf92/32.png) [@lmalafati\_54233](https://community.f5.com/u/lmalafati_54233)\
**Post date:** [December 2, 2010, 12:36pm UTC](https://community.f5.com/t/ssl-offload-and-redirect-pools/38147/3 "2010-12-02T12:36:28Z")

</div>

Hi Chris,

It’s correct. Just to reminder the domain is the same: Ex. [www.domain.com/siteA](http://www.domain.com/siteA) , [www.domain.com/siteB](http://www.domain.com/siteB) and [www.domain.com/siteC](http://www.domain.com/siteC).

Thanks.

Leonardo

---

<div class="post-metadata">

**Author:** ![nitass](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/nitass/32/2270_2.png) [@nitass](https://community.f5.com/u/nitass)\
**Post date:** [December 2, 2010, 1:29pm UTC](https://community.f5.com/t/ssl-offload-and-redirect-pools/38147/4 "2010-12-02T13:29:11Z")

</div>

i did a bit testing. pls feel free to revise.

```tcl
virtual bar {
   snat automap
   destination 172.28.17.55:https
   ip protocol tcp
   rules myrule
   profiles
      clientssl
      http
      serverssl
      tcp
}
pool poola {
   members 10.10.70.110:http
}
pool poolb {
   members 10.10.70.120:http
}
pool poolb_https {
   members 10.10.70.120:https
}
rule myrule {
   when HTTP_REQUEST {
        switch -glob [HTTP::uri] {
                "/siteA*" {
                        SSL::disable serverside
                        pool poola
                }
                "/siteB*" {
                        SSL::disable serverside
                        pool poolb
                }
                "/siteC*" {
                        pool poolb_https
                }
                default {
                         do something
                }
        }
}
}

```

just want to show connection could be established.

```tcl
curl -Ik https://172.28.17.55/siteA
HTTP/1.1 404 Not Found
Date: Thu, 02 Dec 2010 04:46:55 GMT
Server: Apache/2.0.59 (rPath)
Vary: Accept-Encoding
Content-Type: text/html; charset=iso-8859-1

 curl -Ik https://172.28.17.55/siteB
HTTP/1.1 404 Not Found
Date: Thu, 02 Dec 2010 04:46:58 GMT
Server: Apache/2.0.59 (rPath)
Content-Type: text/html; charset=iso-8859-1

 curl -Ik https://172.28.17.55/siteC
HTTP/1.1 404 Not Found
Date: Thu, 02 Dec 2010 04:46:59 GMT
Server: Apache/2.0.59 (rPath)
Content-Type: text/html; charset=iso-8859-1

```

---

<div class="post-metadata">

**Author:** ![Chris\_Miller](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/chris_miller/32/14702_2.png) [@Chris\_Miller](https://community.f5.com/u/Chris_Miller)\
**Post date:** [December 2, 2010, 1:41pm UTC](https://community.f5.com/t/ssl-offload-and-redirect-pools/38147/5 "2010-12-02T13:41:16Z")

</div>

Thanks for doing the switch statement nitass!

Which is the better option? Enabling the Server SSL profile on the Virtual Server and disabling it where necessary via iRule, or not enabling it on the Virtual Server, and enabling it where necessary via iRule?

---

<div class="post-metadata">

**Author:** ![lmalafati\_54233](https://avatars.discourse-cdn.com/v4/letter/l/4bbf92/32.png) [@lmalafati\_54233](https://community.f5.com/u/lmalafati_54233)\
**Post date:** [December 2, 2010, 2:58pm UTC](https://community.f5.com/t/ssl-offload-and-redirect-pools/38147/6 "2010-12-02T14:58:45Z")

</div>

Chris / Nitass,

Thanks for your help!

I will do the test with my sites and I return to you the result!

Leonardo

---

<div class="post-metadata">

**Author:** ![hoolio](https://avatars.discourse-cdn.com/v4/letter/h/f6c823/32.png) [@hoolio](https://community.f5.com/u/hoolio)\
**Post date:** [December 2, 2010, 8:59pm UTC](https://community.f5.com/t/ssl-offload-and-redirect-pools/38147/7 "2010-12-02T20:59:09Z")

</div>

As Chris said, you can use an iRule to selectively disable the server SSL profile. See the SSL::disable wiki page for an example:

[http://devcentral.f5.com/wiki/default.aspx/iRules/ssl\_\_disable](http://devcentral.f5.com/wiki/default.aspx/iRules/ssl__disable)

```tcl
when HTTP_REQUEST {
  set usessl 0
  if { [string tolower [HTTP::uri]] starts_with "/secure" } {
    pool ssl__pool
    set usessl 1
  } else {
    pool static_pool
    set usessl 0
  }
}
when SERVER_CONNECTED {
  if { $usessl == 0 } {
    SSL::disable
  }
}

```

Aaron

---

<div class="post-metadata">

**Author:** ![Daniel\_Alves\_19](https://avatars.discourse-cdn.com/v4/letter/d/51bf81/32.png) [@Daniel\_Alves\_19](https://community.f5.com/u/Daniel_Alves_19)\
**Post date:** [June 29, 2017, 11:40pm UTC](https://community.f5.com/t/ssl-offload-and-redirect-pools/38147/8 "2017-06-29T23:40:15Z")

</div>

Hi guys,

I have the same issue, my VS on 443 port and pools with 80 port. Can I use the same irule ?

---

<div class="post-metadata">

**Author:** ![Kevin\_Stewart](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/kevin_stewart/32/15267_2.png) [@Kevin\_Stewart](https://community.f5.com/u/Kevin_Stewart)\
**Post date:** [June 30, 2017, 10:07am UTC](https://community.f5.com/t/ssl-offload-and-redirect-pools/38147/9 "2017-06-30T10:07:36Z")

</div>

I have the same issue, my VS on 443 port and pools with 80 port. Can I use the same irule ?

Daniel,

You don’t even need an iRule in this case. This is just a simple VIP listening on port 443, with a client SSL profile and a pool that points to servers on port 80. The client SSL profile decrypts the SSL on the client side, and the lack of a server SSL profile allows that traffic to flow unencrypted to the servers.

---

<div class="post-metadata">

**Author:** ![Daniel\_Alves\_19](https://avatars.discourse-cdn.com/v4/letter/d/51bf81/32.png) [@Daniel\_Alves\_19](https://community.f5.com/u/Daniel_Alves_19)\
**Post date:** [June 30, 2017, 2:09pm UTC](https://community.f5.com/t/ssl-offload-and-redirect-pools/38147/10 "2017-06-30T14:09:57Z")

</div>

Ok, I got it, but I have different backend pools with http port, so I need to forward traffic based on URI to those pools. How can I do this with iRule?

---

<div class="post-metadata">

**Author:** ![Kevin\_Stewart](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/kevin_stewart/32/15267_2.png) [@Kevin\_Stewart](https://community.f5.com/u/Kevin_Stewart)\
**Post date:** [June 30, 2017, 2:17pm UTC](https://community.f5.com/t/ssl-offload-and-redirect-pools/38147/11 "2017-06-30T14:17:25Z")

</div>

```tcl
when HTTP_REQUEST {
    switch -glob [HTTP::uri] {
        "/foo*" { pool foo_pool }
        "/bar*" { pool bar_pool }
        "/blah*" { pool blah_pool }
        default { pool default_pool }
    }
}

```

---

<div class="post-metadata">

**Author:** ![Daniel\_Alves\_19](https://avatars.discourse-cdn.com/v4/letter/d/51bf81/32.png) [@Daniel\_Alves\_19](https://community.f5.com/u/Daniel_Alves_19)\
**Post date:** [June 30, 2017, 2:32pm UTC](https://community.f5.com/t/ssl-offload-and-redirect-pools/38147/12 "2017-06-30T14:32:37Z")

</div>

Kevin,

But http\_request is a client side event where is encrypted or just it’ll be executed after the certificate decrypt the packet?

---

<div class="post-metadata">

**Author:** ![Kevin\_Stewart](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/kevin_stewart/32/15267_2.png) [@Kevin\_Stewart](https://community.f5.com/u/Kevin_Stewart)\
**Post date:** [June 30, 2017, 2:35pm UTC](https://community.f5.com/t/ssl-offload-and-redirect-pools/38147/13 "2017-06-30T14:35:24Z")

</div>

If you have a client SSL profile applied to the VIP, traffic will be decrypted (OSI layer 6) and allow HTTP events to fire (layer 7).

---

<div class="post-metadata">

**Author:** ![Daniel\_Alves\_19](https://avatars.discourse-cdn.com/v4/letter/d/51bf81/32.png) [@Daniel\_Alves\_19](https://community.f5.com/u/Daniel_Alves_19)\
**Post date:** [June 30, 2017, 5:42pm UTC](https://community.f5.com/t/ssl-offload-and-redirect-pools/38147/14 "2017-06-30T17:42:53Z")

</div>

Kevin,

it´s working with the irule you gave me, the only strange thing I´ve seen is I need to a / at end of uri or does not work.

Example: [https://teste.domain.com/core/](https://teste.domain.com/core/) (OK) [https://teste.domain.com/core](https://teste.domain.com/core) (Doesn´t work)

My servers are using http port and I saw the location field on HTTP response header like below and it´s right, is there a way to change this that you know ?

Location: "[http://teste.domain.com/core/](http://teste.domain.com/core/) Server: “Microsoft-IIS/8.5”

---

<div class="post-metadata">

**Author:** ![Kevin\_Stewart](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/kevin_stewart/32/15267_2.png) [@Kevin\_Stewart](https://community.f5.com/u/Kevin_Stewart)\
**Post date:** [June 30, 2017, 7:00pm UTC](https://community.f5.com/t/ssl-offload-and-redirect-pools/38147/15 "2017-06-30T19:00:40Z")

</div>

Did you use the -glob option? That allows you to add a wildcard to the end of the pattern, so

```tcl
switch -glob [HTTP::uri] {
    "/core*" { pool core_pool }
}

```

should match “/core” and “/core/”, and “/core/foo”, etc.

---

<div class="post-metadata">

**Author:** ![Daniel\_Alves\_19](https://avatars.discourse-cdn.com/v4/letter/d/51bf81/32.png) [@Daniel\_Alves\_19](https://community.f5.com/u/Daniel_Alves_19)\
**Post date:** [June 30, 2017, 9:47pm UTC](https://community.f5.com/t/ssl-offload-and-redirect-pools/38147/16 "2017-06-30T21:47:36Z")

</div>

Yes, I am using wildcard, but I’ve seen that without final slash the server respond [http://teste.domain.com](http://teste.domain.com), the http header location field has this value and doesn’t connect.

---

<div class="post-metadata">

**Author:** ![Kevin\_Stewart](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/kevin_stewart/32/15267_2.png) [@Kevin\_Stewart](https://community.f5.com/u/Kevin_Stewart)\
**Post date:** [June 30, 2017, 9:52pm UTC](https://community.f5.com/t/ssl-offload-and-redirect-pools/38147/17 "2017-06-30T21:52:31Z")

</div>

I think you’re suggesting that traffic gets to the correct pool member, but that the server itself requires the trailing /.

Is that correct?