Forum Discussion

Goran_Blomquis1's avatar
Goran_Blomquis1
Icon for Nimbostratus rankNimbostratus
Aug 31, 2005

change respons HTTP to HTTPS

Hi all,

 

 

Maybe this is an easy question.

 

Using BigIp for SSL offload to a Exchange server. Exchange server respond with a 302 redirect and send "Location: http://whatever.se/exchange/\r\n”

 

 

that causes client to use http instead of https.

 

 

I guess that i can replace http to https in HTTP_RESPONSE_DATA using I-rules.

 

 

Also is it possible to replace just "http://" to "https" or do I have to rewrite the hole uri.?!

 

 

 

Can someone help me whit an example?

 

 

Have a great day

 

 

Goran B

 

application delivery
dev
devops
iRules

5 Replies

Sort By
  • bl0ndie_127134's avatar
    bl0ndie_127134
    Historic F5 Account
    Aug 31, 2005
    If you need to modify just the Location header on the 302 response from 'http' to 'https', you can do that using the profile 'http redirect rewrite all'
  • Rodney_Newton_7's avatar
    Rodney_Newton_7
    Icon for Nimbostratus rankNimbostratus
    Sep 02, 2005
    I am having the same problem with OWA terminating SSL on the BigIP... as you suggested I modified the profile to "redirect rewrite all" and it now gets passed the login but when it builds the page you only see the frames. Inside the frames I am getting page cannot be displayed. Any ideas?
  • adamp_1519's avatar
    adamp_1519
    Icon for Nimbostratus rankNimbostratus
    Sep 10, 2008
    i am having the same issue:

     

     

    internet -> F5/https -> OWA/http .. i dont want to use a https server profile, as we run the F5->OWA connection through content inspection, so we need it clear text.

     

     

    what is the most efficient way to do this?

     

     

    passing the "FRONT-END-HTTPS: on" header doesn't seem to work with Exchange 2007.

     

     

    re-writing every single URI response from http->https seems computationally expensive..

     

     

     

    damn microsoft, why do they need to rewrite the entire uri, why not just the page or everything after /

     

     

     

     

    your link (below) gives me an access denied (after logging in)

     

    http://devcentral.f5.com/Default.aspx?tabid=29&newsType=ArticleView&articleId=56
  • adamp_1519's avatar
    adamp_1519
    Icon for Nimbostratus rankNimbostratus
    Sep 10, 2008
    I have re-written the 302-redirect, and so far OWA on Exchange 2007 seems fine.

     

     

     

    i use this fairly global rule, however i bind the irule to the webmail virtual-server only.

     

     

     

    when HTTP_RESPONSE {

     

    if { [HTTP::is_redirect] }{

     

    HTTP::header replace Location "[string map {"http://" "https://"} [HTTP::header Location]]"

     

    }

     

    }
  • John_Keller's avatar
    John_Keller
    Icon for Nimbostratus rankNimbostratus
    Feb 05, 2009
    Good day to you all.

     

     

    I've had some issues with migrating a website from our Cisco CSS11500 load balancer to our shiny new LTMs. I've migrated over 40 sites so far from the CSSes to LTMs, but this one is rather difficult. This site is very heavy on the Javascript side, and secure. When a specific action is launched on the site, the client attempts to send a request to a non-secure object on the page (whose browser immediately alerts them to the nonsecure object being requested). What's more is that this doesn't occur in the CSS environment, which is most troubling. adamp's solution above appears to have resolved this issue, with modifying the URI from http to https. Devcentral has assisted with several other challenges that I've overcome, and I thank you all for the great wealth of knowledge shared here.

     

     

    -John Keller