Forum Discussion

Maze_Runner_200's avatar
Maze_Runner_200
Icon for Nimbostratus rankNimbostratus
May 28, 2015

Outbound VS

I have two virtual servers. One of the virtual servers is a wildcard server that has a SSL server profile that requires a certain type of certificate and an iRule that does SSL checks. The second server requires a different certificate than the first and has an iRule that does not do SSL checks but is used to encrypt. It has been proven that both functions work separately but when both are used it will only use the wildcard server. How can it be done to use each virtual server for the purpose that it was created for?

 

4 Replies

  • please explain more about your setup. much depends on how the other virtual server is setup and where exactly your wildcard virtual server is listening.

     

    in general you can't have two servers listening on the same ip / port. so you will have to do something where one matches there correct the traffic and the other the rest.

     

  • The goal was to have an outbound wildcard VS with an SSL server profile with an iRule that does certificate verfication for the majority of users. There would then be a second VS that would have a different SSL profile with an iRule except this VS would not be as strict for the certificate requirement.

     

    I now have it working. Here is what had to be done: -On the second VS specify a destination, the reason was that this would make it different from the wildcard server. I did reference order of precedence for VS's. -On the wildcard server it did have a source listed for a subnet that the traffic was suppose to come from. But it only half worked, and the reason was that it was trying the second VS first which is what traffic was suppose to do but when traffic did not match the second VS then nothing happened. -I realized that the issue now was do to SNAT being used on both the outbound VS's. So when traffic tried the second VS first it did try to send to the wildcard server but the wildcard server could not accept it because of SNAT. I changed the source on the wildcard server 0.0.0.0/24 and everything worked as it should.

     

    • boneyard's avatar
      boneyard
      Icon for MVP rankMVP
      thanks for letting us know. if you can flag your question as answered.