ACE30: match http url except specific one

[lliska]

Hi,

is it possible to construct the L7 HTTP class-map expression to match all URLs except one?

I have 1 correct url, for example: /correcturl.* and want to redirect requests to all other possible URLs to this one, without the need to list them all in "possitive match" statements.

I tried variations of:

match http url /^(correcturl).*

with no luck.

Thanks,

Lubomir

[jsirstin]

Lubomir,

It sounds like what you need is to create the L7 class-map to match on the correct url and loadbalance this to the serverfarm. Then in this same L7 policy use class class-default to redirect all other URLs to the correct location.

Hope that helps

Best regards

Jim

[lliska]

Hi Jim,

thanks for your reply. Normaly, your advice would be fine, but I also need to insert client certificate fields to the packets destined to rservers (end to end SSL), and action lists with SSL header inserts are only allowed in class-default. So the correct URL must be processed in this class.

Best wishes,

Lubomir

[jsirstin]

Lubomir,

Unfortunately I cannot think of a way to do this. Anything that does not match your L7 class-maps will be sent to class class-default. Unless you can come up with some kind of regex match that will cover all possible incoirrect URLs I do not really see how this could work.

Best regards

Jim

[lliska]

Jim,

I thought there was a way to write an url match statement, that would exclude my correct URL. In the documentation (http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA4_1_0/configuration/slb/guide/classlb.html#wp1313278) there is an option to exclude a character:

[^charset]

Do not match any character in the range

If there would be a way to exclude the whole string (= the exact sequence of more characters), this whould be what I need. But I can not find the correct way to configure it, and maybe this is not possible at all.

Thank you very much for your answers.

L.

[jsirstin]

Lubomir,

Can you provide some samples of what the incorrect URLs would look like as well as correct ones? You are correct that we can instruct the ACE to ignore some characters in a string but the rest of the regex must still match exactly for the class to be hit.

Regards

Jim

[lliska]

Hi Jim,

server people asked us to only allow access to:

www.host.com/public/>

We should block (redirect to /public) requests to all other url, for example:

www.host.com/devel/>

www.host.com/test1/>

and others, which may not be known now.

Regards,

Lubomir