Forum Discussion

KMA_50449's avatar
KMA_50449
Icon for Nimbostratus rankNimbostratus
Jul 16, 2008

Reverse proxy SSL with LTM : https with bigip, then http

Hi,

 

 

We have LTM with ssl accelerator card, so time to use them !

 

 

What I try to do seems easy :

 

 

Request :

 

Client -> https -> Bigip with sslclient profile -> http -> webserver

 

 

Answser :

 

webserver -> http ->Bigip with sslclient profile -> https -> client

 

 

I want that my LTM handle all the ssl requests, decode them and sent in clear text http requests to the web server.

 

 

To do that I've upload my own certificate and key and create a sslclient profile with these cert/key.

 

 

Then I've created a pool with IP of my web server and port 80 (for http, don't want my web server encrypt or decrypt anything).

 

 

Last I've created the Virtual Server, listening on port 443 with my sslclient profile as SSL Profile (Client) option, Protocol Profile (client) is TCP.

 

No SSL profile server needed, and all other option of the VS are to none of not checked.

 

 

I choose my previous pool in the resources tab with source_addr for persistence profile.

 

 

Then I try to access to my website trough the VS ip, I have to certificate send by the Bigip and then ... nothing : "The network link was interrupted while negotiating a connection. Please try again." in my firefox browser

 

 

I try to tcpdump request, and none of them arrived to my web server from the bigip when I try to load the page, while the http health monitor works fine...

 

 

I've read many docs, all the forum, wiki ... and do not find where I failed

 

 

Sur I miss something, if someone could help me ?

 

 

config
design

17 Replies

Sort By
Show More
  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Jul 17, 2008
    Most apps have a checkbox to handle ssl offloaders, but if yours doesn't, you can use the stream profile to change http:// links to https:// links in the responses. If you do this, you'll need to change your http profile to rechunk responses.
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jul 17, 2008
    If you add an HTTP profile with rewrite redirects enabled, LTM will rewrite the 30x redirects from http to https.

     

     

    Aaron
  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Jul 17, 2008
    hmmm, second post I've seen today where the emoticons are broken...
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jul 17, 2008
    Citizen_elah's suggestion would work to rewrite the HTTP payload's reference(s) from http to https. The http profile rewrite redirect option would apply to the Location header in responses.

     

     

    If you test and find that the redirects are to http, then you can use an HTTP profile to fix it. If the references to https are in the payload then you can use a stream profile and STREAM::expression based rule to fix it.

     

     

    Aaron
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jul 17, 2008
    I think it's when you edit a post with an emoticon that the code for it isn't re-rendered as an emoticon. Or at least that's one issue.

     

     

    Aaron
  • Jo_Anglin_5148's avatar
    Jo_Anglin_5148
    Historic F5 Account
    Oct 22, 2009
    KMA,

     

     

    did you find a resolve. if so, what was the irule you wrote to resolve this problem?

     

     

    thanks

     

     

    jem
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Oct 22, 2009
    Hi Jo,

     

     

    I think the initial fix was to create a custom HTTP profile with rewrite redirects enabled. This would rewrite HTTP references in the Location header to HTTPS. If you need to rewrite response content (like HTML) from http:// to https:// you can use a stream profile and STREAM::expression iRule. There are examples on the STREAM::expression wiki page (Click here).

     

     

    Aaron