07-08-2011 12:51 AM
Hello,
I'm looking into a solution, where I need to insert a header-value in the http-header, which will later be used by a Websphere Application Server to retrieve the original client ip. Currently, this is done using a Websphere-plugin on the HTTP server, which extracts the src.ip from the L3-header and generates, among other, two distinct header-values, $WSRA and $WSRH (think it's short fo RemoteAdress and RemoteHost). Theese values can the be intercepted by the Websphere server and provide some insight into the L3-information of the originating host.
This however, challanges my routing table, as I need to point my default-route towards the ACE and do an obscene amount of static routing toward public networks used by applications. Consequently, I'm planning on doing src.nat on the ACE on traffic destined for the web-portal, but past attempts to do so, presented a problem, as the only address the WAS-administrators could see, was the nat-address.
IBM has published a piece of paper, explaning this flow, which also involves setting the ACE as a trusted proxy. I'm thinking of doing the following and would very much appreciate, if anyone could validate this approach/method:
action-list type modify http al-websphere-insert-client-srcip
header insert $WSRA header-value %is
header insert $WSRH header-value %is
policy-map type loadbalance pmap-lb-web
class class-default
serverfarm [something]
al-websphere-insert-client-srcip
Thanks
/Ulrich
Solved! Go to Solution.
07-08-2011 05:58 AM
Hi Ulrich,
I think it would be easier by using the insert-http command under the policy-map config.
In your case, it would look something like this:
host1/Admin(config)# policy-map type loadbalance http first-match L7SLBPOLICY
host1/Admin(config-pmap-lb)# class L7SLBCLASS
host1/Admin(config-pmap-lb-c)# insert-http Client-src header-value %is
This will add to the http request a new header with name Client-src and with the source IP of the client as value.
Just keep in mind that you'll need to attach this to a L7 policy to have it inserted and that you need to configure persistent rebalance if you want this header to be inserted in all requests.
More info on the command:
Regards,
Nicolas
07-08-2011 05:58 AM
Hi Ulrich,
I think it would be easier by using the insert-http command under the policy-map config.
In your case, it would look something like this:
host1/Admin(config)# policy-map type loadbalance http first-match L7SLBPOLICY
host1/Admin(config-pmap-lb)# class L7SLBCLASS
host1/Admin(config-pmap-lb-c)# insert-http Client-src header-value %is
This will add to the http request a new header with name Client-src and with the source IP of the client as value.
Just keep in mind that you'll need to attach this to a L7 policy to have it inserted and that you need to configure persistent rebalance if you want this header to be inserted in all requests.
More info on the command:
Regards,
Nicolas
07-08-2011 04:33 PM
Hi Nicolas,
Thanks for your reply.
I'll give your suggestion a try.
/Ulrich
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide