Forum Discussion

f51's avatar
f51
Icon for Cirrostratus rankCirrostratus
Aug 16, 2017

Endless Redirction Loop

Hi DC,

 

One VIP configured on port 80 and now we want to use on port 443. So when I created VIP on 443 and added redirection irule for VIP:80. But when I am trying to access the https://abc.expert.com it is giving endless redirection loop but it is working good on port 80.

 

Any suggestons please.

 

application delivery
LTM

5 Replies

Sort By
  • cjunior's avatar
    cjunior
    Icon for Nacreous rankNacreous
    Aug 16, 2017

    Could you share your configuration for vs and irule used?

     

    Regards

     

  • f51's avatar
    f51
    Icon for Cirrostratus rankCirrostratus
    Aug 16, 2017

    ltm virtual Dev.vs { destination 20.12.145.52:http ip-protocol tcp mask 255.255.255.255 pool Dev.vs profiles { http { } tcp-lan-optimized { } } source 0.0.0.0/0 source-address-translation { type automap } translate-address enabled translate-port enabled vs-index 287 }

     

  • f51's avatar
    f51
    Icon for Cirrostratus rankCirrostratus
    Aug 16, 2017

    ltm pool Dev.vs { members { abc:http { address x.x.x.x session monitor-enabled state up } def:http { address y.y.y.y session monitor-enabled state up } } monitor min 1 of { http gateway_icmp tcp } }

     

  • f51's avatar
    f51
    Icon for Cirrostratus rankCirrostratus
    Aug 16, 2017

    for 443 config I am not added the pool but if I add the pool, it is giving endless loop ltm virtual Dev.443 { destination x.x.x.x:https ip-protocol tcp mask 255.255.255.255 profiles { abc.wildcard { context clientside } http { } tcp-lan-optimized { } } source 0.0.0.0/0 source-address-translation { type automap } translate-address enabled translate-port enabled vs-index 286 }

     

  • cjunior's avatar
    cjunior
    Icon for Nacreous rankNacreous
    Aug 16, 2017

    It looks like you are in this scenario:

    1: Client request VS:80

    2. VS:80 send redirect to VS:443

    3. VS:443 does SSL offload and send clear traffic to a pool member

    4. Pool member send clear traffic redirect to http://abc.expert.com, and it start the loop.

    So, you may need to rewrite the pool member response to https traffic, like this:

    when HTTP_REQUEST {
    STREAM::disable
    set host [getfield [HTTP::host] ":" 1]
}
when HTTP_RESPONSE {
    if { [HTTP::header value Content-Type] contains "html" } {
        STREAM::expression "@http://$host@https://$host@"
        STREAM::enable
    }
    if { [HTTP::is_redirect] && [string tolower [HTTP::header Location]] starts_with "http://$host"} {
        HTTP::header replace Location [string map -nocase "http://$host https://$host" [HTTP::header Location]]
    }
}

    Here in DC have many examples that you can use 🙂

    Regards.