ACE Transparent SSL off loading

[aeliu]

HI,

I configured transparent ssl offload as below, it works, port 443 of ALL IP will be transfered to 7001.but dont know how to make an exception, anybody help ~

rserver host MSFC
  ip address 192.168.1.1
  inservice

serverfarm host sf_transparent
  transparent
  rserver MSFC 7001
    inservice

policy-map type loadbalance http first-match transparent_ssl
  class class-default
    serverfarm  sf_transparent

class-map match-all ssl-vip
  2 match virtual-address 0.0.0.0 0.0.0.0 tcp eq https

policy-map multi-match SSL_OFFLOAD
  class ssl-vip
    loadbalance vip inservice
    loadbalance policy transparent_ssl
    ssl-proxy server qa_ssl

interface vlan 111
service-policy input SSL_OFFLOAD

[Gilles Dufour]

What kind of exception do you need ?

A source ?  In this case, you need to create class-map to match source ip adress.

A destination ? In this case, you also create a class-map but with a virtual-ip and you add it before the one currently configured.

Gilles.

[aeliu]

Thanks for reply Gilles,

what I want is destination exception, and with no VIP, is it possible?

and I tried ACL as below, not working

access-list transparent_test extended deny tcp any host 192.168.3.2 eq 443
access-list transparent_test extended  permit tcp any any eq 443

class-map match-all ssl-vip
match access-list transparent_test

Regards

Aeneas

[Gilles Dufour · Accepted solution]

What do you want to do for this traffic ?

Just forward transparently ?

Why don't you want to use the virtual command ?

Gilles