ACE One-Arm Source-NAT HTTP Header Insert

[robert.horrigan]

Hellow ACE Gurus,

This is probably a dumb question but I'm looking for info on HTTP Header Insert for SSL sessions.  Does the HTTP header re-write action list work for SSL traffic?  I guess I'm not clear on whether or not the header is encrypted and if the ACE can modify on an HTTPS session.  Any input would be greatly appreciated.

/r

Rob

[Daniel Arrondo Ostiz · Accepted solution]

Hi Rob,

When using HTTPS, all the data is encrypted, including the HTTP headers.

In such a situation, if you want to insert headers (or do any other kind of L7 processing), you will have to configure the ACE to do SSL termination. Once the connection is decrypted, the ACE can do any processing it needs before sending the connection towards the server either in clear text or again using HTTPS.

I would recommend you to have a look at the link below. This is an example of how to configure an ACE for end-to-end SSL (so, HTTPS on both sides of the ACE). In the example, the only L7 processing that is being done is matching on the URL, but it would be enough to replace that part with whatever header insertion commands you need
http://www.cisco.com/en/US/partner/products/hw/modules/ps2706/products_configuration_example09186a00809c6f37.shtml

If you still need more help to understand any of the points involved in the process, please, do not hesitate to contact me again.

Regards

Daniel

[robert.horrigan]

Daniel,

Great!  Just what I was looking for.  Thanks so much - rate 5.