iRule or LTM Policy to pre-fix desired www. sites

Question

I have an issue where if I browse to https://abc.com the page will not load ( connection timed out) but https://www.abc.com&nbsp;will load as desired.Therefore, I believe I&nbsp;need to somehow modify the following iRule to check to see if it contains www. and if it doesn't add it.&nbsp;when HTTP_REQUEST {
 if { [class match [HTTP::host] equals Datagroup1] } {
  pool prod_sites
  } else {
  HTTP::respond 403
  }
}However, I have a couple URIs in the data group that contains a subdomain that I don't want to prefix with www.I know I can change it with the following but I'm struggling to determine a way to redirect those in Datagroup1 with exceptions. I'm assuming its going to be a messy if, elseif, else kinda of deal but having a hard time putting it all together and working.when HTTP_REQUEST {
    if {[HTTP::host] eq "abc.com"} {
        HTTP::redirect "https://www.abc.com[HTTP::uri]"
    }
}maybe specifying a not equal for exclusions ??if { ([HTTP::host] ne "subdomain.cbs.com") } {I also currently have a policy in place to redirect HTTP to HTTPS as follows:Redirect to location 'tcl:https://[getfield [HTTP::host] : 1][HTTP::uri]' at request time.Any suggestions would be greatly appreciated.

niels_van_sluis · Answer

What about this solution? Use the same Datagroup1, and define the allowed hosts as 'strict' if they shouldn't be modified by the iRule. In the example below 'nielske.nl' isn't allowed to be modified.

And use Datagroup1 with the following iRule.
when HTTP_REQUEST {
  if { [class match [HTTP::host] equals Datagroup1] } {
    if { !([HTTP::host] starts_with "www.") &amp;&amp; !([class lookup [HTTP::host] Datagroup1] equals "strict") } {
      log local0. "[HTTP::host] doesn't starts_with www. and isn't defined as strict; redirect allowed"
      HTTP::redirect "https://www.[HTTP::host][HTTP::uri]"
    }
  } else {
  HTTP::respond 403
  }
}

niels_van_sluis · Answer

What is the reason in your example that https://abc.com&nbsp;doesn't work? Is it because there isn't a DNS-record? In that case you could use the RESOLVER::name_lookup to see if it's a valid record. If not, add www. to it.
See:&nbsp;RESOLVER::name_lookup (f5.com)

doublejz · Answer

To be honest I'm not sure. I do see that abc.com and www.abc.com resolves differently but I feel like its something to do on Akamai as the traffic hits there before it gets directed to the F5 VS.

Looking at this more, http://abc.com, http://www.abc.com and https://www.abc.com all work. Just not https://abc.com nor does it redirect.

niels_van_sluis · Answer

Okay, then it seems abc.com and www.abc.com&nbsp;are different sites and abc.com isn't configured to handel HTTPS traffic. In that case you are probably better of using two datagroups. One datagroup that lists all allowed hostnames and another that contains hostnames that should be excluded from having put www. to it. Then let the iRule decide if it's allowed and/or it's needs to be modified with the start of www.

doublejz · Answer

Understood. I created a new datagroup Datagroup_exclude and placed the subdomain sites in it. I guess I went full circle back to my original question now though. How would you go about checking to see if it needs to be modified with www and exlude those in the new datagroup?

Forum Discussion

iRule or LTM Policy to pre-fix desired www. sites

8 Replies

Recent Discussions

Content type hearder charset=UTF-8

Web acceleration

Create a CSR and Key using the BigIP LTM GUI when renewing a certificate

Enterprise Security best practices with F5 WAF

Disk space full - what files, folders are safe to delete?

Related Content

Auditing Security Policy Updates

Minimizing Security Complexity: Managing Distributed WAF Policies

ANSIBLE Configuration of a firewall rule list to be added on desired position in the firewall policy

LTM Policy

Access policy, LTM policy and iRules