Forum Discussion

SL's avatar
SL
Icon for Cirrus rankCirrus
Sep 17, 2015

httponly option without http profile

Hi All

 

Is it at all possible to enable the httponly option other than using cookie or ASM?

 

Reason for the question is that I am trying to enable ASM for IBM Endpoint Manager for Remote Control. As soon as I enable the http profile the connection does not initiate correctly, the user gets the initial logon page and it hangs on when the secure connection is trying to be established between the user and server.

 

I am thinking that it has something to do with that the Endpoint Manager is creating some sort of Tunnel and does not want anyone to inspect or look at the traffic in anyway, thus does not work when enabling http profile. As this allows the F5 to see the traffic flow.

 

Any suggestions? anyone been able to use IBM Endpoint Manager for Remote Control with ASM enabled?

 

Thanx Sulaiman

 

application delivery
ASM Advanced WAF
deployment
LTM
security
TMSH

8 Replies

Sort By
  • Robert_Teller_7's avatar
    Robert_Teller_7
    Historic F5 Account
    Oct 06, 2015

    You can try enabling the HTTP Profile and then using an iRule to disable HTTP for any request that isn't RFC compliant.

    I have attached a snippet that will verify that the first portion of the request contains a string followed by a forward slash.

    For an HTTP Request

    when CLIENT_ACCEPTED  {
    HTTP::disable

    TCP::collect 20
}
when CLIENT_DATA {
    scan [TCP::payload] {%s %c} METHOD REQUEST
    if {$METHOD ne "" && $REQUEST eq "/"}
    {
        HTTP::enable
    }

    TCP::release
}

    For an HTTPS Request

    when CLIENT_ACCEPTED  { HTTP::disable }
when CLIENTSSL_CLIENTHELLO { SSL::collect 20}

when CLIENTSSL_DATA {
    scan [SSL::payload] {%s %c} METHOD REQUEST
    if {$METHOD ne "" && $REQUEST eq "/"}
    {
        HTTP::enable
    }
    SSL::release
}
    • SL's avatar
      SL
      Icon for Cirrus rankCirrus
      Oct 20, 2015
      Hi Robert I created and enabled the iRule, it still says that I need to enable a SSL Profile
  • Brad_Parker's avatar
    Brad_Parker
    Icon for Cirrus rankCirrus
    Oct 20, 2015

    You can not use an HTTP profile without a ClientSSL profile for HTTPS traffic. Is your virtual server HTTP or HTTPS? If it is HTTPS and you need end-to-end SSL you will also need a ServerSSL profile to re-encrypt.

     

    • SL's avatar
      SL
      Icon for Cirrus rankCirrus
      Oct 23, 2015
      Hi Brad That is the way I understand it to work as well, was just asking if anyone was able to get it to work without the http profile. It is a https virtual server, the issue is application related in that it does not allow us to inspect the traffic, thus when I enable the http profile the application doesnt work via the F5.
    • Brad_Parker's avatar
      Brad_Parker
      Icon for Cirrus rankCirrus
      Oct 23, 2015
      Enabling the HTTP profile in and of itself will not affect the traffic in any way and is transparent to the application. Do you have SSL profiles enabled? They too should be transparent to the application. How does your application "not work"? There is no way to see or alter the payload of encrypted traffic, that's why HTTPS requires client ssl profiles if you want to see the content.
  • Brad_Parker_139's avatar
    Brad_Parker_139
    Icon for Nacreous rankNacreous
    Oct 20, 2015

    You can not use an HTTP profile without a ClientSSL profile for HTTPS traffic. Is your virtual server HTTP or HTTPS? If it is HTTPS and you need end-to-end SSL you will also need a ServerSSL profile to re-encrypt.

     

    • SL's avatar
      SL
      Icon for Cirrus rankCirrus
      Oct 23, 2015
      Hi Brad That is the way I understand it to work as well, was just asking if anyone was able to get it to work without the http profile. It is a https virtual server, the issue is application related in that it does not allow us to inspect the traffic, thus when I enable the http profile the application doesnt work via the F5.
    • Brad_Parker_139's avatar
      Brad_Parker_139
      Icon for Nacreous rankNacreous
      Oct 23, 2015
      Enabling the HTTP profile in and of itself will not affect the traffic in any way and is transparent to the application. Do you have SSL profiles enabled? They too should be transparent to the application. How does your application "not work"? There is no way to see or alter the payload of encrypted traffic, that's why HTTPS requires client ssl profiles if you want to see the content.