topic hello kanwal,forst of all , in Application Networking

ACE HTTP header response redirect does not work

mwannemacher — Mon, 02 Feb 2015 17:26:53 GMT

hello team,

i am dealing for a while now with the issue, that we want to replace a windows server maschine doing in IIS only a redirect of http://autodiscover.domain.tld to https://autodiscover.exchange.tld/autodiscover. since it is needed for each client, there is "some" administrative overhead we want to prevent for each new client.

so i configured the following in ACE (snipped)

action-list type modify http autodiscover-redirect
header rewrite response location header-value "https://autodiscover.exchange.tld/autodiscover" replace "http://autodiscover.*.*"

action-list type modify http 80-to-443-rewrite
ssl url rewrite location ".*"

rserver redirect 01_redirect_80-to-443
webhost-redirection https://%h%p 301
inservice

rserver redirect 03_response_redirect_autodiscover
webhost-redirection http://%h%p 301

serverfarm redirect 01_redirect_80-to-443
rserver 01_redirect_80-to-443
inservice

serverfarm redirect 03_response_redirect_autodiscover
rserver 03_response_redirect_autodiscover
inservice

class-map type http loadbalance match-all 02A_autodiscover.*.*
2 match http header Host header-value "autodiscover.*.*"
4 match http url /

policy-map type loadbalance first-match 21_Exchange-HTTPS-Policy

class 02A_autodiscover.*.*
action autodiscover-redirect
class class-default
sticky-serverfarm 21_Exchange-cookie-sticky_443
action 80-to-443-rewrite

but it always is redirecting me directly within the same session to https://autodiscover.exchange.tld/autodiscover instead telling the client to make a new request for https://autodiscover.exchange.tld/autodiscover.

thank you for suggestions.

manuel

Hi Manuel,Are you doing ssl

Kanwaljeet Singh — Tue, 03 Feb 2015 14:55:38 GMT

Hi Manuel,

Are you doing ssl termination on ACE? Also, send me the existing "interesting" configuration and i will send you the configuration example.

Regards,

Kanwal

Note: Please mark answers if they are helpful.

hello kanwal,forst of all ,

mwannemacher — Tue, 03 Feb 2015 15:05:58 GMT

hello kanwal,

forst of all , thank you for your reply :).

in this case no. i got it work this night (after hours of headache). my problem was the redirect of http requests to https on the same IP for direct exchange access.

so i altered the configuration as follows to another free IP and it works instantly:

rserver redirect 01_redirect_80-to-443
webhost-redirection https://%h%p 301
inservice

serverfarm redirect 01_redirect_80-to-443
rserver 01_redirect_80-to-443
inservice

action-list type modify http 80-to-443-rewrite
ssl url rewrite location ".*"

action-list type modify http 141F_autodiscover-redirect
header rewrite response location header-value "https://autodiscover.exchange.tld/autodiscover" replace "http://autodiscover[.]*[.]*"

class-map match-all 01_redirect_80-to-443-Class
2 match virtual-address A.B.C.D tcp eq www

class-map match-all 141A_redirect_80-to-443-Autodiscover_Class
2 match virtual-address A.B.C.D tcp eq www

class-map type http loadbalance match-all 141C_autodiscover.*.*
2 match http header Host header-value "autodiscover.*.*"
4 match http url /

policy-map type loadbalance first-match 01_redirect_80-to-443-Policy
class class-default
serverfarm 01_redirect_80-to-443

policy-map type loadbalance first-match 141B_redirect_80-to-443-Autodiscover_Policy
class 141C_autodiscover.*.*
serverfarm 01_redirect_80-to-443
action 141F_autodiscover-redirect

policy-map multi-match vlan_504_in
class 141A_redirect_80-to-443-Autodiscover_Class
loadbalance vip inservice
loadbalance policy 141B_redirect_80-to-443-Autodiscover_Policy
nat dynamic 110 vlan 21

but i recognized that the ACE is handling the redirect other than the ARR feature in windows 2012 since in windows for redirect we get a HTTP 200, in ACE the new URL is pushed back to the client and a SSL connection is made instantly.

in fact it works, but the HTTP => HTTPS redirect in windows seems faster than the ACE redirect. this is something i can not catch at the moment. may be we can improve the configuration?

thank you in advance.

manuel