policy
55 TopicsPolicies to move HTTPS traffic
I am trying to share a 443 NAT on a firewall sending traffic to the LTM. Once it gets to the F5 I want formview.xxx.org to go to pool-Forms and WEBview.xxx.org to go to pool-WEB. Is that possible with HTTPS traffic? Do the nodes need to use http? Its been 10 years since I have worked on LTMs - I have a fair amount of refreshing and catching up. Thanks in advance. John801Views2likes19CommentsIs it possible to use the following Irule syntac with TCL in a policy ?
Hello, I've setup some code in an Irule . This concerns a code that will take the URI, within this uri, search for first directory in the path and put it tolower before sending it to the server. set uri [HTTP::uri] set block [lindex [split $uri /] 1] if { $block ne [string tolower $block]} { set block2 [string tolower $block] HTTP::uri [string map [list $block $block2] $uri] #log local0. "Rewrited part of the URI : $block2" #log local0. "URI Send to Back-end application : https://[HTTP::host][HTTP::uri]" } Is it possible to put this code in a TCL within a policy rule ? I need to replace the first directory of the URI (ie: "/APPLICATION/dir1/DIR2/index.html") to lowercase /application/dir1/DIR2/index.html ( the rest of the URI must stay intact, only /Application/ part must be set to lowercase. Thanks in advance. Regards Frédéric545Views1like2CommentsClient-Certificate and IP-Whitelisting via Policy or iRule?
We have a requirement to verify for a valid client-certificate (not expired and issued from a trusted CA), but also accept a bypass if the source-IP is trusted. I have the following questions for the two different configuration options: Policy In the condition section for "SSL certificate" it says "common name with index", is this the number of the certificate (same as the iRule command "SSL::cert <index>")? Does this mean I can only verify the standard CN of it? In the documentation it's only mentioned "Inspects the properties of an SSL certificate", which sounds to me I can also verify e.g. issuer name, serial number of the issuer or expiration dates. So which value do I have to enter here? Or in other words, how can I check that the presented client-certificate is really issued from a trusted CA and not from a fake CA with the same CN? Assuming the first question can be answered positively, is it correct, that I simply create two rules based on "first match" to forward traffic (first rule for client-cert check, second rule for IP-whitelisting) and if none of the rules are matching, traffic will be blocked? Assuming above mentioned policy-setup is not possible, I would configure the client-cert check within an iRule. iRule Is the option "Trusted Certificate Authorities" from the clientSSL-profile used if I set "Client Certificate" to request? And if so, do I have to use any special iRule commands to do this? If the list of trusted CA from the clientSSL-profile can't be used within the iRule, which other commands best "simulate" this kind of check? I mean a string comparison for the issuer CN name is not a good option, because I can create my own CA, if I know the allowed CA-name. Is the serial number a better option? Or in other words, same question as above,how can I check that the presented client-certificate is really issued from a trusted CA and not from a fake CA with the same CN? The IP-whitelisting can be simply added in an else branch then, right? Thank you! Regards Stefan 🙂Solved2KViews1like7CommentsTrying to assign a policy to a virtual server
i am trying to change policies on a virtual server, using the python sdk. i load the vs, i can load the existing policy on the vs, and delete it, but when i try to create a new policy for the vs, i get a 404 error saying that the policy cannot be found. ## load the virtual server vs = mgmt.tm.ltm.virtuals.virtual.load(name="serviceMain", partition ="partition", subPath = "subPath") ## load the policy. this works policy = mgmt.tm.ltm.policys.policy.load(name="pol_name", partition ="partition", subPath = "subPath") ## load existing policy from the vs and delete it. this works pol = vs.policies_s.policies.load(name="pol_name", partition ="partition", subPath = "subPath") pol.delete() ## create a new policy. this fails mgmt.tm.ltm.policys.policy.create(name="pol_name", partition ="partition", subPath = "subPath") i get this error: Text: '{"code":404,"message":"01020036:3: The requested policy (pol_name) was not found.","errorStack":[],"apiError":3}' the policy exists, and was loaded earlier in the script, but it can't be found. i have tried other methods of attaching the policy, and they have all failed. any ideas? thanks, -tSolved1.5KViews1like11Comments