HTTPS Redirect with no SSL termination on F5

Question

Hi, I am trying to setup HTTPS redirect so all the traffic to https://www.example.com/  go to 
https://www.example.com/guest, but this HTTPS virtual server is not using F5 to do SSL offload, so F5 to backend server is HTTPS not HTTP. &nbsp;
I tried using F5 to decrypt the HTTPS traffic by loading an SSL client cert to this virtual server, so it can use iRule, and then encrypt it before it sends back to server, but couldn't get that to work. &nbsp;
I wonder if F5 can do this kind of redirect, with iRule or something else.&nbsp;
Thanks in advance!&nbsp;

nitass · Answer

I tried using F5 to decrypt the HTTPS traffic by loading an SSL client cert to this virtual server, so it can use iRule, and then encrypt it before it sends back to server, but couldn't get that to work.

can you post the configuration?

 tmsh list ltm virtual virtual_server_name
 tmsh list ltm pool pool_name

can you post the configuration?
 tmsh list ltm virtual virtual_server_name
 tmsh list ltm pool pool_name

nitass_89166 · Answer

I tried using F5 to decrypt the HTTPS traffic by loading an SSL client cert to this virtual server, so it can use iRule, and then encrypt it before it sends back to server, but couldn't get that to work.

can you post the configuration?

 tmsh list ltm virtual virtual_server_name
 tmsh list ltm pool pool_name

can you post the configuration?
 tmsh list ltm virtual virtual_server_name
 tmsh list ltm pool pool_name

nathe · Answer

Hummingbird,&nbsp;
Yes f5 can do this. Apply a Client SSL profile to the VS to decrypt/terminate the SSL traffic. Use the certificate for the hostname required i.e. www.example.com.&nbsp;
If you then want to re-encrypt to the backend then you can simply apply the default serverssl Server SSL profile to the VS too.&nbsp;
As for redirecting the uri then you can use an iRule, else a HTTP Class Profile (applied to the VS) or a Local Traffic Policy too (if using TMOS 11.4 and above).&nbsp;
Hope this helps,&nbsp;
N&nbsp;

hummingbird_143 · Answer

Here is the config:

tmsh list ltm pool airgroup-https-pool
ltm pool airgroup-https-pool {
    members {
        10.79.107.228:https {
            priority-group 1
            session monitor-enabled
        }
        10.68.118.138:https {
            priority-group 2
            session monitor-enabled 
        }
    }
    min-active-members 1
    monitor https
}

tmsh list ltm virtual airgroup-https-vs 
ltm virtual airgroup-https-vs {
    destination 10.68.220.25:https
    ip-protocol tcp
    mask 255.255.255.255
    pool airgroup-https-pool
    profiles {
        tcp { }
    }
    snat automap
    translate-address disabled
}

And I'll try the client/server profile as suggested by Nathan.

hummingbird_143 · Answer

Here is the config:

tmsh list ltm pool airgroup-https-pool
ltm pool airgroup-https-pool {
    members {
        10.79.107.228:https {
            priority-group 1
            session monitor-enabled
        }
        10.68.118.138:https {
            priority-group 2
            session monitor-enabled 
        }
    }
    min-active-members 1
    monitor https
}

tmsh list ltm virtual airgroup-https-vs 
ltm virtual airgroup-https-vs {
    destination 10.68.220.25:https
    ip-protocol tcp
    mask 255.255.255.255
    pool airgroup-https-pool
    profiles {
        tcp { }
    }
    snat automap
    translate-address disabled
}

And I'll try the client/server profile as suggested by Nathan.

Forum Discussion

HTTPS Redirect with no SSL termination on F5

10 Replies

Recent Discussions

Failed to convert character dclid=%EDclid!

ASM - Parent policy vs OWASPcompliance

Rewrite uri translation not working

CONNECTION IS LOST DUE TO SELF IP IS DELIVERED

APM OCSP Responder Issues

Related Content

HTTP To HTTPS Redirect 301

Anchor Link Redirect

FTPS_SSL_ Termination

Http redirection

HTTP URI Replace/Redirect