topic Re: ACE: url rediection in Application Networking

ACE: url rediection

gavin han — Sun, 03 Apr 2011 14:55:08 GMT

Hi,

I need to do url redirection. I've worked on CSS alot so far but I'm new bie to ACE.

for example - my CSS config for url rediction is as follow:

service server1:443
ip address 192.168.1.1
protocol tcp
port 443
keepalive type ssl
active

service server2:443
ip address 192.168.1.2
protocol tcp
port 443
keepalive type ssl
active

service server1:80
type redirect
redirect-string "https://mail.google.com/exchange"
ip address 192.168.1.1
no prepend-http
active

service server2:80
type redirect
redirect-string "https://mail.google.com/exchange"
ip address 192.168.1.2
no prepend-http
active

owner mail
content mail.google.com:443
    vip address 10.10.10.1
    port 443
    protocol tcp
    application ssl
    add service server1:443
    add service server2:443
    advanced-balance sticky-srcip
    active

content mail.google.com:80
    vip address 10.10.10.1
    protocol tcp
    port 80
    url "/*"
    add service server1:80
    add service server2:80
    active

what would be equivalent ACE config? please advise....

Re: ACE: url rediection

Surya ARBY — Sun, 03 Apr 2011 16:08:19 GMT

I'm not a CSS expert but you want to redirect requests coming in HTTP to HTTPS right ?

I guess the following example should do the job :

rserver redirect https-target

webhost-redirection https://mail.google.com/exchange

inservice

serverfarm redirect secure-redirect

rserver https-target

inservice

In the webhost-redirection you can add at the end of the command a 301 or a 302 if you want to send different types of redirection per RFC 2616

Just use this serverfarm as target in your classmap dedicated to the port 80

Re: ACE: url rediection

gavin han — Sun, 03 Apr 2011 21:54:25 GMT

Thanks. How about "ssl" for port 443. do I need to worry about it?

Re: ACE: url rediection

Surya ARBY — Sun, 03 Apr 2011 22:00:10 GMT

no. It's only basic L4 load balancing with a virtual server listening on port 443. Use my previous answer in your previous topic, the config is very close to what I posted before.

Re: ACE: url rediection

gavin han — Mon, 04 Apr 2011 18:17:01 GMT

Yes, you're correct. I want to redirect requests coming in HTTP to HTTPS..

Hi, can you advise if config would look like below:

Do I have to specifiy port 80 somewhere? can you pls check if following config looks good?

rserver server1:443
ip add 192.168.1.1
inservice

rserver redirect server1:443
ip add 192.168.1.1
webhost-redirection https://mail.google.com/exchange
inservice

serverfarm redirect secure-redirect-SF
probe port80
rserver redirect server1:443
inservice

serverfarm secure-rediect-SF
probe port443
reserver server1:443
inservice

sticky ip-netmask 255.255.255.0 address both secure-rediect-SG
timeout 60
replicate sticky
serverfarm secure-rediect-SF

class-map match-any secure-rediect-CM
match virtual-address 10.10.1.1 tcp any

policy-map type loadbalance first-match secure-rediect-PM
class class-default
   sticky-serverfarm secure-rediect-SG

policy-map multi-match LBR-LB
class secure-rediect-CM
   loadbalance vip inservice
   loadbalance policy secure-rediect-PM
   loadbalance vip icmp-reply

Re: ACE: url rediection

Surya ARBY — Mon, 04 Apr 2011 18:28:59 GMT

probe tcp generic-tcp
  interval 5
  passdetect interval 20
  passdetect count 2
  connection term forced
exit

rserver server1
  ip add 192.168.1.1
  inservice
exit

rserver server2
  ip add 192.168.1.2
  inservice
exit

rserver redirect https-target
  webhost-redirection https://mail.google.com/exchange
  inservice 
exit

serverfarm redirect secure-redirect
  rserver https-target
  inservice 
exit

serverfarm host SF443
  failaction purge
  predictor leastconns
  probe generic-tcp
  rserver server1 443
    inservice
  rserver server2 443
    inservice
exit
exit


sticky ip-netmask 255.255.255.255 address source SF443-SG
  timeout 3600
  replicate sticky //only required if HA is in use
  serverfarm SF443
exit

class-map match-any www-CM
  2 match virtual-address 10.10.10.1 255.255.255.255 tcp eq www
exit

class-map match-any https-CM
  2 match virtual-address 10.10.10.1 255.255.255.255 tcp eq 443
exit

policy-map type loadbalance first-match http-PM
  class class-default
    serverfarm secure-redirect
exit
exit

policy-map type loadbalance first-match https-PM
  class class-default
    sticky-serverfarm SF443-SG
exit
exit

policy-map multi-match LBR-LB
  class www-CM
    loadbalance vip inservice
    loadbalance policy http-PM
    loadbalance vip icmp-reply
  class https-CM
    loadbalance vip inservice
    loadbalance policy https-PM
    loadbalance vip icmp-reply
exit
exit

interface vlan xxx
  ip address xxx
  alias xxx
  peer ip address xxx
  access-group input xxx
  service-policy input LBR-LB
  no shutdown
exit

Re: ACE: url rediection

stmccabe — Mon, 04 Apr 2011 18:41:39 GMT

The only reason you would need to worry about 443 when doing web host redirection on the ACE is if the backend rservers are setting the location header (e.g., http://website.com/), this will get forwarded to ACE, ace will reencrypt and send on to client. The client will see the location header and build a new HTTP connection to ACE which will break the flow..

You can have your webadmins either ensure they are not setting location header and/or implement ssl url-rewrite on the ACE via action list:

For example:

action-list type modify http HTTP-To-HTTPS
header rewrite response location header-value ".*http*" replace "%1https%2"
ssl url rewrite location ".*"

Re: ACE: url rediection

Surya ARBY — Mon, 04 Apr 2011 18:50:23 GMT

in this case, SSL offload is required, I didn't talk about that as it seems to be a migration from CSS, I assume the application already works without ssl rewrite

Re: ACE: url rediection

gavin han — Mon, 04 Apr 2011 18:55:58 GMT

Thank you so much 😃

Re: ACE: url rediection

gavin han — Mon, 04 Apr 2011 18:58:14 GMT

yeah it should work but we need to have ssl as well