Forum Discussion

Danny_Arroyo's avatar
Oct 17, 2014

Can the F5 Bigip act as a proxy for a specific VIP

We have a HTTPS VIP on the F5. The web servers (pool members) serve pages that have several external links that are not https. Is it possible to have the F5 proxy these http links and present them via the https VIP?

 

7 Replies

  • It is if you set the F5 up as the proxy. Otherwise the client will go via it's proxy. Of course you can point these at another http VIP on the F5. You can get the LTM to change the links on the fly if you want to change the links.

     

  • I don't think mine is an "answer" so I put it as "comment" There are 2 types of traffic you mentioned, one from your web server (those pool member), the other from "external servers" these links from your web server/pages. If you want to, you can re-write these external link from "HTTP" to "HTTPS", but are those external web server going to support HTTPS if you change it?? Please make sure that server support HTTPS and then you can change them.. actually be better modify the web page links (at your web server) from http to https... F5 LTM is load balance device, traffic balance by it but not provide by it.
  • So in the first example - setting the f5 as the client proxy you would create a wildcard virtual server on port 80 and configure the client with this as its web proxy.

     

    In the second example you would create a streams profile or html profile to rewrite from the original link to a host which maps to the IP address of a Virtual Server configured on the f5. Obviously you'd have to be sure that the URLs are available on the servers.

     

  • Just to update my question.

     

    I called F5 support and they informed me that this would require a pretty complex irule that would have to make several adjustments. They informed me that the irule would have to take into account several scenarios. We decided to take another route.

     

    Thanks for everyone's help.

     

  • kunjan's avatar
    kunjan
    Icon for Nimbostratus rankNimbostratus

    If the said sites support https, may be you can just rewrite the http to https in the response payload using an iRule.

     

    But if need to proxy with F5, one option could be to explore using this iRule https://devcentral.f5.com/wiki/iRules.proxypassv10.ashx

     

    or use APM portal which does it all more easily.

     

  • The said sites may or may not support https. Many of them are rss feeds that are built by the faculty. Do you think this irule will work if the VIP is an https VIP and several of the existing links being served by the pool members are http links?