BIG-IP : redirect loop : debugging techniques
BIG-IP 11.4.0 Build 2384.0 Final In my hosts file I point www.mydomain.com to my web-server IP, and in my client-browser I submit the request http://www.mydomain.com/natural-language-url-1 and the page is returned as expected.. In BIG-IP , I have configured a single virtual-server vip-01 with a single iRule irule-01 : when HTTP_REQUEST { log local0. "HTTP_REQUEST received by irule-01" log local0. "host = [HTTP::host]" log local0. "uri = [HTTP::uri]" switch -glob [string tolower [HTTP::host]] { "www.mydomain.com" { switch -glob [string tolower [HTTP::uri]] { "/api/*" { pool service-pool-01 } default { log local0. "matched default pool" pool default-pool-01 } } } } } Now, in my hosts file I point www.mydomain.com to vip-01 , and in my client-browser I submit the request http://www.mydomain.com/natural-language-url-1 and the client-browser reports an infinite-redirect error "This webpage has a redirect loop" BIG-IP > System > Logs > Local Traffic Rule /Common/irule-01 : HTTP_REQUEST received by irule-01` Rule /Common/irule-01 : host = www.mydomain.com Rule /Common/irule-01 : uri = /natural-language-url-1 Rule /Common/irule-01 : matched default pool ... repeat 10 times ... Fiddler shows that 21 302-redirects have occurred : Result 302 Protocol HTTP Host www.mydomain.com URL /natural-language-url-1 Body 185 Caching private Content-Type text/html; charset=utf-8 Process chrome:7516 Comments Custom NOTE 1 : on vip-01, Source Address Translation = Auto-Map NOTE 2 : I have complete control over the web-server ( remote access with ability to modify configuration, run diagnostics, perform local tests, etc. ) NOTE 3 : The web-server expects the request to include the domain. Sending a request with host = {web-server-host-name} , or host = {web-server-ip} will throw an error because IIS will be unable to locate the virtual app. What are some debugging techniques I can deploy to further diagnose the underlying cause of the redirect loop ?
iRule - http redirect and x-forward
Hi folks, I need help to check if my iRule on LTM A (external) is redirecting the traffic to LTM B VIP correctly and iRule on LTM B will help keep the users host and uri and display the page on the servers. LTM A (External): ------------------------------- VS: vs_abc_com_test Destination IP: Public IP:80 Pool: pool_efg Member: 10.10.30.30 iRule on VS: "abc.com" { if { [HTTP::uri] starts_with "/test"} { pool pool_abc_test snat automap } else { HTTP::redirect "https://abc.com[HTTP::uri]" } } Pool in iRule: pool_abc_test Member: 10.10.10.1 ----------------- which is the VIP on LTM B LTM B (Internal): ----------------------------- VS: vs_pool_abc2_test2 Dest IP: 10.10.10.1 Pool: pool_abc2_test2 Members: 20.20.20.1:80 20.20.20.2:80 iRule on VS: when HTTP_REQUEST { if { ([HTTP::uri] contains "/xyz/login.aspx") || ([HTTP::uri] contains "/uvw/login.aspx")}{ if {not [HTTP::header exists "X-Forwarded-For"]} { HTTP::header insert X-Forwarded-For [IP::client_addr] } } }iRule w/Special Character (#) in Original URI
I am using my standard redirect syntax, however I believe it is broken due to using a in the source URI. I've tried using a \ to escape it, as well is curl brackets with no success. Help would be greatly appreciated! when HTTP_REQUEST priority 450 { switch -glob [string tolower [HTTP::host]] { "www.integration.domain.com" { switch -glob [string tolower [HTTP::uri]] { "/blah1/blah2.aspx/" { HTTP::respond 301 Location "https://www.integration.domain.com/newsite/site.aspx!/" }
The Dreaded %20 for space
Does anyone have a idea how to create a iRule that takes into account spaces between words? I have the iRule below and when I enter abc.def.com/en-ca/Teams/Performance Improvement/0700Reports/default.aspx, the browser adds a %20. Example: http://abc.def.com/en-ca/Teams/Performance%20Improvement/0700Reports/default.aspx when HTTP_REQUEST { if { ([string tolower [HTTP::host]] contains "abc.def.com") and [HTTP::uri] starts_with "/en-ca/Teams/IT/IM/default.aspx" } { HTTP::redirect "http://def.ghi.com/IM2/default.aspx" } elseif { ([string tolower [HTTP::host]] contains "abc.def.com") and [HTTP::uri] starts_with "/en-ca/Teams/Performance Improvement/0700Reports/default.aspx" } { HTTP::redirect "http://def.ghi.com/PerformanceMeasures/0700Reports/default.aspx" } } Thoughts? RGW
2 http request rules merge to one - one referer the other set access only
Hi I have two rules that work individually. But when i try and combine get no luck and just redirects everything to the default location. The first rule is to only allow the uri path in the irule, otherwise redirect to Unathorized page. Second is to only allow the request if it comes via 3 set referers. It would be much appreciated if someone can please help combine both of these? 1st RULE when HTTP_REQUEST { set uri [string tolower [HTTP::uri]] switch -glob $uri { "/path1/path2/path3*" - "/path4/path2/path3*" - "/path1/path2/path5*" - "/path4/path2/path5*" { redirect to Pool pool POOL_Servers_to_access-80 } default { log local0. "Other access not allowed $uri” HTTP::redirect "http://www.notallowed.asp" } } } 2nd RULE when HTTP_REQUEST { switch -glob [string tolower [URI::host [HTTP::header "Referer"]]] { "goodlocation.com/*" - "anothergoodlocation.com/*" - "youcanalsologin.com/*" { } redirect_to_location_to_sign_in_first "" { HTTP::redirect "http://goodlocation.com" } Allow Request to go through... default { pool POOL_Servers_to_access-80 } } } Thanks in advance. cheers Brett
How to overcome "Only secure content is displayed"?
Hi, I am load balancing to a web server which uses backdrop mapping. I have created an Virtual Server listening on HTTP which applies the "_sys_https_redirect" iRule to redirect from HTTP to HTTPS which contains the following: when HTTP_REQUEST { HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri] } I have then created a second Virtual Server listening on HTTPS that presents the SSL certificate and then simply load balances to the pool members (passing traffic to them on TCP port 80). The problem that I am getting is that some pages contain backdrop mapping from openstreetmap.org (URL is similar to http://a.tile.openstreetmap.org/b/c/d/png where a b c and d can vary). Firefox and Chrome do not display this embedded backdrop mapping but Internet Explorer does at least show a message saying "Only secure content is displayed". If I then click on the "Show all content" button, the mapping does appear. I have searched the forums and have tried creating a custom http profile with edited "Request header insert" to insert the X-Forwarded-Proto but must be doing it wrong as i get an error "01070373:3: Invalid Header Insert 'X-Forwarded-Proto' for profile /Common/http_osnet. name:value must be ":" separated" I am fairly new to LTM so any help greatly appreciated.Need to redirect URI to URI (or URL to URL) in an iRule for hosted URL to an unhosted server
I am sure this is a something super simple, but I am not entering in the right search terms. I am fairly new to the F5, but experienced in Linux. We host dozens of servers with different hosts and URIs. Management wants to centralize all redirects on the F5 for better track of what's getting redirected where. So far, we have done this successfully with domains (hosts) to URI's: when HTTP_REQUEST { set host [string tolower [HTTP::host]] if { $host contains "2014floorplan.example.com"} { HTTP::redirect "http://expocad.example.com/vendors2014/ec/forms/attendee/indexTab.aspx" } elseif { $host contains "fubar.example.com"} { HTTP::redirect "http://community.shrm.org/fubar/support/" } This works. But what if I wanted to take a web URL/URI like: anyone who goes to **www.example.com/email** gets redirected to **www.thirdpartysite.com/mailform?customer=example_assoc&ID=8675309** I have tried many things based on many forum posts and devcentral, but I am sure I am not searching for the right terms. Here's what I am currently trying (and it's not working) ``when HTTP_REQUEST { set location [string tolower [HTTP::uri]] switch -glob [HTTP::uri] { "www.shrm.org/email" { HTTP::respond 301 Location "http://thirdparty.com/abc/" } } } I am sure this can be done, but I am not understanding the syntax. Also, is there a way to make the URL look like www.example.com/email/ so the user does not know they are in another third party site?
Redirecting a Redirect?
Good evening! I had a question regarding a specific task we've been been researching. We are at a university, and we have a cluster of servers that are used for single sign-on purposes by faculty and staff. There are three servers being load-balanced in one-arm mode. The VIP we have setup first redirects you to a CAS server for authentication, then using cookies will forward you to one of the three servers to access content. The problem we are being faced with now is that we have a satellite campus affiliated with our university who want to use our SSO servers, but want their own specific look and feel. They have registered there own URL which they wish to redirect (via CNAME I'm assuming) to the VIP of our cluster, from which they expect to see content unique to their campus. So basically, we want to setup a mechanism where any requests originating from their URL is redirected to a specific subdirectory on our SSO cluster. Now we've already thought up a solution for this issue which involves creating a new secondary VIP which the satellite campus will redirect to and using a unique SNAT IP that will identify the requests as coming from the satellite campus. This solution however seems particularly wasteful as we would have to waste another one of our public IP addresses just to allow them their unique view access. We thought of simply enabling the X-Fowarded-For header but they also want public access to the server and trying to define which public IP's belong to them would be an impossible task (internally, they have their own unique subnet). So this comes to the Irule option. I'm pretty certain there is a way to use Irules to complete this task but I'm struggling badly with it, so here I am requesting help from people who are more familiar with it than me. Anyone know how to go about implementing such a solution? I'll provide a more specific illustration of what I'm trying to achieve below. Basically, our SSO cluster has a VIP DNS of "www.example.edu/maincampus". We want to setup a unique view for the satellite campus at "wwww.example.edu/satellite". The satellite campus has registered their own domain at say "satellite.redirect.edu". The goal therefore is that when they implement their CNAME that redirects "satellite.redirect.edu" to "www.example.edu", the load balancer then forwards that to the correct subdirectory "www.example/satellite" I have a basic idea of doing an IF statement where we do something like this: when HTTP_REQUEST { if { [HTTP::Request] == "satellite.redirect.edu" }{ HTTP::redirect "https://www.example.com/satellite" (maybe use HTTP::uri instead of the full path?) } } Am I on the right track? Is it possible? Any help would be much appreciated :). Thank you for taking the time to listen.iRule redirect to https if condition doesn't match
I need to send traffic to appr pools on port 80 based on a specific Host and URI combination and all other traffic should get redirected to https irrespective of Host and URI combination. I have below iRule that works fine for my port 80 work. Please suggest what to append to redirect traffic to https otherwise. Redirect to https should be based on [HTTP::host] when HTTP_REQUEST { switch -glob [HTTP::host][HTTP::uri] { "sample1.ehosts.net/word1/word2*" { pool sample1.ehosts.net_word } "sample2.ehosts.net/word1/word2*" { pool sample2.ehosts.net_word } "sample3.ehosts.net/word1/word2*" { pool sample3.ehosts.net_word } } }
iRule to redirect application to pool and change url
When setting up a f5 irule, I am trying to do the following: When an external url is hit, redirect to an internal pool of servers based on a url. Example: external= I want this to map to server pool of urls: server1.com:8080/application or server2.com:8080/application or server3.com:8080/application I need it to only direct if the server url is up. Does anyone have an idea? Basicly going to ww.abc.com/test redirect/proxies to server2.com:8080/application/test. and redirect/proxies to server2.com:8080/application. This is what I have so far: when HTTP_REQUEST { switch -glob [string tolower [HTTP::path]] { "/application*" { pool This_abc.com_WEB-R_8080 snatpool WEB-R_SNAT_Pool } } }