Forum Discussion

Chip_Anderson's avatar
Chip_Anderson
Icon for Nimbostratus rankNimbostratus
Nov 02, 2007

Applying iRules to SSL

Feeling like a noob right about now. We've been load balancing our SSL servers for years using just a regular Virtual Server hooked up to a standard pool, but now we need to add a simple iRule into the mix. Just something that sends the request to a different pool based on the URI. Here's the rule:

 

 

 

when HTTP_REQUEST {

 

 

set uri [HTTP::uri]

 

 

if {$uri starts_with "/signup"} {

 

use pool testsslpool

 

} else {

 

use pool sslpool

 

}

 

}

 

 

There were some messages here in DevCentral that implied that things like HTTP_REQUEST worked fine in SSL rules like this. I honestly couldn't find something that authoritatively stated whether that was true or not.

 

 

Assuming that the rule is correct(?), we hit a problem when we try to insert it into our existing port 443 Virtual Server. When we try to plug it in, we get an error:

 

 

"01070394:3: HTTP_REQUEST event in rule (sslpicker) requires an associated HTTP or FASTHTTP profile on the virtual server (sslserver)."

 

 

If I go back and change the Virtual Server and set the "HTTP Profile" setting to "http", then the Virtual Server stops working. i.e., browser requests to the SSL web page never complete. FWIW, at that point I _can_ plug the rule into the server, but it doesn't do me much good because the server won't return any responses.

 

 

What am I missing here? Any hints?

 

 

Thanks in advance,

 

Chip

1 Reply

  • You absolutely can use an iRule within a SSL Virtual, but only if your virtual is terminating the client SSL connection. Odds are you don't have a clientssl profile attached to your virtual to allow for decrypting the traffic. With out decryption on the BIG-IP, there's no way for the iRules engine to be able to look at the HTTP requests. Odds are that by applying the HTTP profile without clientside ssl, it's running into some trouble trying to map the encrypted content into a HTTP request.

     

     

    -Joe