Forum Discussion

Antony2015's avatar
Antony2015
Icon for Altostratus rankAltostratus
May 11, 2015

ACLs and "action-list" feature compatibility in F5

Hello All,

 

we have existing ACLs and "action-list" feature used in ACE as shown below..

 

For an example :

 

  1. ACL in ACE

access-list n-ACL line 2 extended permit tcp host x.x.x.x x.x.x.x range 7101 7102

 

(Traffic policy rule in F5 LTM or add ACLs in AFM ???)

 

  1. action-list in ACE

action-list type modify http test_HTTPS-to-HTTP ssl url rewrite location "test.f5.com" ssl url rewrite location ".test.f5.com." clearport 46110

 

( Redirect Rewrite options in HTTP profile or X-SSL irule ???)

 

Could you please advise where we can add these features in F5 ?

 

Any help would be highly appreciated..

 

1 Reply

  • When I convert ace configurations to F5, I usually disregard the ACL lines since the F5 is a default deny box. The box is essentially locked down to whats allowed via Virtual Servers, so the ACL lines are not really needed to be brought over from Ace. Just make sure you have a good understanding of all the traffic flows through the F5 device. (Create forwarding virtual servers as needed to route traffic)(Lock down using AFM, Packet Filters, Irules, if necessary)

     

    For the "action-list" type, it would seem that you would need to use an HTTP profile to rewrite http redirects that come from the web server to "https" so that the connection stays secure. Here is more information about this:

     

    sol14775: Configuring an HTTP profile to rewrite URLs so that redirects from an HTTP server specify the HTTPS protocol (10.x and 11.x) https://support.f5.com/kb/en-us/solutions/public/14000/700/sol14775.html

     

    Also Here is more information about the action-list command from the ace configuration guide. http://www.cisco.com/c/en/us/td/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA3_x/command/reference/actnlist.htmlwp1050875

     

    (config-actlist-modify) ssl url rewrite location

     

    To specify the SSL URL, SSL port, and clear port for rewrite, use the ssl url rewrite location command. SSL URL rewrite changes the redirect URL from http:// to https:// in the Location response header from the server before sending the response to the client. By doing so, it allows you to avoid nonsecure HTTP redirects because all client connections to the web server will be SSL, thus ensuring the secure delivery of HTTPS content back to the client. Use the no form of this command to remove the SSL rewrite