Issue with ACE HTTP class map

[ppatki]

This is what I want to achieve USING the ACE as a reverse proxy.

User uses the url https://abc/password - gets to the destination server & the web page

If user tries to use any thing additional then the connection is dropped at the ACE such as

https://abc/password/test or any such variation.

Following is the config I have to achieve this

class-map type http loadbalance match-any L7-CLASS-TEST

  match http url /password

  match http url /password/

!

class-map type http loadbalance match-any L7-CLASS-TEST-deny

  2 match http url .*.*

!

!

policy-map type loadbalance first-match LBP-TEST

  class L7-CLASS-TEST

    serverfarm FARM-TEST

    ssl-proxy client TEST

  class L7-CLASS-TEST-deny

    drop

  class class-default

    serverfarm FARM-TEST

    ssl-proxy client TEST

!

The problem with this is when the page opens I get broken links on all the images. If I use the following line

match http url /password.*

I get the images to work but the user can use the https://abc/password/test which is not what I want.

Has any one faced this issue ?

Any help will be appreciated.

Thanks in advance

Prasanna

[Jorge Bejarano · Accepted solution]

Prasanna,

What about if you try it in HTTP and apply the following change?

class-map type http loadbalance match-any L7-CLASS-TEST-deny

  2 match http url /.*

This should work in HTTP but not with HTTPS

Anyway, it should not work since everything seems to be encrypted, you may require either SSL-termination or END-TO-END SSL for this then the ACE can decrypt the request see what it needs to do and take the load balance decision.

Jorge

[ppatki]

The issue was with allowing the image files. I allowed all the image file types in the permit class map in addition to the ones i have permitted already. That now workes.

My appologies i by mistake enabled the tab of correct answer for the privious comment from jorge