Forum Discussion

kend's avatar
kend
Icon for Nimbostratus rankNimbostratus
Jul 19, 2013

iRule to Redirect to a Specified Pool

We have a lot of customers, and it continues to grow, who connect to our servers in the data center using Microsoft RDP and an assigned URL. The customers connect to the URL we provide them using the RDP client on their local desktop. The public IP assigned to this URL is NATted to the virtual server IP address on the LTM. From there, they are directed to the assigned pool. Each customer has their own unique URL which has an unique public IP address. So, the problem is we are using up a lot of public IP addresses. What we would like to do is assign one public IP address to multiple customer URL's and then use an iRule to redirect these connections to the correct pool based on some value obtained from the RDP TCP payload. I know RDP sends a routing token that contains the username, but that would not work since there could be a "jsmith" at any or all of the customer sites connecting. So, is there any other value that can be parsed from the RDP TCP payload which is unique to the customer that can be used to determine which pool they get redirected to on the LTM?

 

5 Replies

  • From a uniqueness perspective, you have the possibility of a named user value as you've stated, and potentially IP addresses. When clients open their local RDP client, do they specify credentials there, and do they specify a domain attribute? Or do they authenticate once inside the RDP session?
  • kend's avatar
    kend
    Icon for Nimbostratus rankNimbostratus

    The user value will not work in this case. The format of the field is domainname/username and the domainname is longer than 9 characters (Microsoft restricts this value to 9 characters). Even if the format was using the username first, there could be multiple "jsmith" usernames from different customers connecting. So, I need to use some other value is available. When users connect with their RDP client, they use the URL we give them and domainname/username.

     

  • Not a perfect solution and not sure if you've attempted this, but try user@domain. You have a much better chance of uniqueness unless the username is 8 characters or more.

     

     

    Take a look at this thread:

     

     

    https://devcentral.f5.com/community/group/aft/32250/asg/50

     

  • just wondering if we can use port number (i.e. one port number per customer).