Forum Discussion

Scott_27805's avatar
Scott_27805
Icon for Nimbostratus rankNimbostratus
Mar 21, 2012

HTTPS Passthrough not working

In our current environment we use SSL offloading for our Exchange 2010 Outlook Web Access through our F5. We need to stop this just for the MRSProxy service and not any other traffic to the server. I created the iRule below and applied it to the virtual server. However we are still seeing the requests for this URL come through on port 80 instead of 443 in the IIS logs on the OWA server. Can anyone help and tell me where I went wrong? Thanks.

 

 

 

when HTTP_REQUEST {

 

if { [HTTP::uri] starts_with "/EWS/mrsproxy.svc"}{

 

SSL::disable clientside

 

}

 

}

 

 

We are seeing GET /EWS/mrsproxy.svc – 80 in the IIS log and we should get GET /EWS/mrsproxy.svc - 443
application delivery
dev
devops
iRules

18 Replies

Sort By
Show More
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Mar 21, 2012
    Brian, You can't disable client SSL based on the requested HTTP URI as the SSL would have to have already been used to decrypt the request to parse the URI.

     

     

    Scott, what's the actual issue you're trying to address for this specific URI?

     

     

    Aaron
  • Scott_27805's avatar
    Scott_27805
    Icon for Nimbostratus rankNimbostratus
    Mar 21, 2012
    We are engaging with Microsoft to migrate our Student email to Live@EDU which needs to connect to the MRSProxy service at the URL /EWS/mrsproxy.svc. In talking with their support engineer, the process doesn't support SSL offloading so I just need to disable the offloading only for these requests. The service only accepts encrypted traffic on 443.
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Mar 21, 2012
    Thanks for clarifying. I think you should be able to add a server SSL profile to the virtual server and then disable it for all but the specific URI: 

    
when CLIENT_ACCEPTED {
 Save the name of the VS pool before this iRule could change the current pool
set default_pool [LB::server pool]
}
when HTTP_REQUEST {
 If the request is for a proxy.svc URI select a separate pool
 Leave serverssl enabled
if { [HTTP::path] eq "/EWS/mrsproxy.svc"}{
pool webmail_443_pool
} else {
 For all other URIs disable serverssl and use the VS default pool
SSL::disable serverside
pool $default_pool
}
}

    Aaron
    • jdsuni_201283's avatar
      jdsuni_201283
      Icon for Nimbostratus rankNimbostratus
      May 08, 2015
      Hi Scott, we need to do exactly the same on our F5, but have never worked with iRules before... can you tell me what I need to do to make this happen? Thanks in advance!