IRule Newbie needs help with simple redirection

Assuming the requests are standard http, or you are terminating SSL on the LTM, this should work for you:

when HTTP_REQUEST {
  if { [string tolower [HTTP::host]] equals "url.mydomain.com" } {
    pool pool1
  } elseif { [string tolower [HTTP::host]] equals "url2.mydomain.com" } {
      pool pool2
  } else { pool default_pool }
}

Thank you very much.

 

 

One quick quesstion. A friend just sent me the follwing to try.

 

 

rule Select_correct_pool {

 

when HTTP_REQUEST {

 

set uri [HTTP::uri]

 

if { $uri starts_with "/url2/" }

 

{ pool pool2 }

 

else { pool pool1 }

 

}

 

 

What's the difference?

 

 

I am trying to the web interface of one of two citrix servers.

HTTP::host is the value supplied by the client in the host header. HTTP::uri is everything in the URL after the host.

 

 

http://HOST/URI

 

 

Note that the slash after the host is the first (and sometimes only) character in the URI string.

Thank you once again.

 

 

Your rule suggestions seems a little cleaner to me and I believe I will try using that one.

Can you explain to me how this would work with SSL termination?

 

 

In my case, I have 2 sites (https://site1.mydomain.com and https://site2.mydomain.com) and each has its own SSL cert and profile in LTM.

 

 

Currently, I have 2 separate VS, each with its own IP, client SSL profile, and pool assigned. In order to reclaim some IP addresses, I'd like to change the configuration so that both sites go to the same VS, but the correct cert and pool is used.

 

 

Thanks for the help.

You can't do it with SSL, sorry. The SSL key exchange happens before the BIG-IP can see the Host header and thus the BIG-IP can't know which certificate to present to the client. So unless you want to use one certificate for both sites (which would cause browser warnings) then you are out of luck. The only option is if you can get a wildcard cert (for *.mydomain.com for example). This is a limitation of SSL, not the BIG-IP.

That's exactly what I was thinking... you can't know which cert to use until you see the packet headers, and you can't get the packet headers without the cert.

 

 

I'll have to talk my boss into looking at getting a wildcard cert.

 

 

Thanks.