Forum Discussion

Deon's avatar
Deon
Icon for Nimbostratus rankNimbostratus
Mar 11, 2013

ProxyPassSSLProfiles Internal Data Group Issue

 

I am having a problem with v10.9 of ProxyPass. I've setup the internal string data group ProxyPassSSLProfiles with one name-value pair. It appears that the findclass statement below that attempts to look up the ssl profile from the data group is not working correctly. I am on TMOS v11.2.0.

 

 

set profilename [findclass $pool ProxyPassSSLProfiles " "]

 

 

After inserting a log statement to view the value of profilename I see the value it has been set to is the name of the pool and not the ssl profile from the data group.

 

 

I got it to work by changing the line of code with the findclass to the following.

 

 

set profilename [class match -value -- $pool equals ProxyPassSSLProfiles]

 

 

I am thinking that the findclass is not working because of the name-value separator ':=' that is used in the internal string type data group. Is there a way to specify a space as a name-value separator like it mentions to do in the instructions that accompany ProxyPass? Or maybe I am misreading the instructions on how to setup the internal string type data group.

 

application delivery
dev
devops
iRules

2 Replies

Sort By
  • Deon's avatar
    Deon
    Icon for Nimbostratus rankNimbostratus
    Mar 12, 2013
    I was able to get ProxyPass v10.9 to function properly on TMOS v11 with only the change mentioned in my above posting - using class match instead of findclass.

     

     

    I also discovered that in v11.2 where it now supports and defaults to strict secure renegotiation in the server side SSL profile. My lab test was failing with the following message in the log file.

     

    warning tmm1[7283]: 01260017:4: Connection attempt to insecure SSL server (see RFC5746) aborted: ...

     

     

    Setting the "Secure Renegotiation" setting in the server SSL profile to "Request" fixed this issue for me. I mention this ssl profile setting because obviously it is related to the ProxyPass iRule in the context above (i.e. ProxyPassSSLProfiles, etc.) and it is a change from v10.

     

     

    Cheers

     

    -Deon
  • Jnon's avatar
    Jnon
    Icon for Nimbostratus rankNimbostratus
    Mar 15, 2013
    you won't be able to run 11.x code on the 3400 -