VS config with multiple IIS sites

Separate VIPs and pools are certainly one way, but this is what it might look like otherwise:

1. Port 80 VIP and simple iRule to redirect all requests to port 443 VIP.

2. Port 443 VIP (same IP address), a client and server SSL profile, 2 pools, and an iRule:

   when HTTP_REQUEST {
       switch [string tolower [HTTP::host]] {
           "abc.xyz.com" {
               pool abc_pool
           }
           "abc12.xyz.com" {
               pool abc12_pool
               SSL::disable serverside
           }
       }
   }
   

The abc_pool would contain your port 443 servers and the enabled serverssl profile would appropriately re-encrypt to these servers. The abc12_pool would contain your port 80 servers and the iRule would disable the serverssl profile.

Why don't you just have abc.xyz.com and abc12.xyz.com DNS addresses resolve to different IP addresses so they hit separate VS on the BIG-IP, therefore allowing you to do the different things you're looking for.

Either that, or you need to have an iRule that selects a different pool and also disables serverside SSL. Something like:

when HTTP_REQUEST { if { [HTTP::host] eq "abc12.xyz.com" } { pool SSL::disable serverside } }

But separating to two separate VS is the easiest thing to do, unless you have a certificate that has the multiple hostnames in it (SAN or wildcard).

In addition to wildcard and SAN certs you could use SNI. However, separate VIPs would be the easiest to configure/troubleshoot/maintain in my opinion.

Disabling SSL serverside will expose your traffic in the DMZ - this may constitute a security policy violation.

By the way, is there a specific reason the IIS instances are bound to specific hostnames?