03-06-2013 12:18 PM
Hi Guys,
I want to exclude on specific site from SSL. I know I need to do a URL match for this but I can for the life of me figure it out.
The url is acedemo.poweradvocate.com/index.html currently this is redirected to https like all my other url's/
Here is my config.
crypto chaingroup WWW-PROD-CHAINGROUP
cert AddTrustExternalCARoot.crt
cert COMODOHigh-AssuranceSecureServerCA.crt
access-list allow line 8 extended permit ip any any
probe icmp PROBE_SERVICE_ICMP
interval 5
passdetect interval 5
receive 5
probe tcp TCP7001_PROBE
port 7001
interval 5
passdetect interval 5
receive 3
connection term forced
open 2
rserver host 228-WLS11host1
ip address 192.168.211.228
inservice
rserver host 229-WLS11host2
ip address 192.168.211.229
inservice
rserver redirect REDIRECT-TO-HTTPS
webhost-redirection https://%h%p 301
inservice
serverfarm redirect REDIRECT-SERVERFARM
rserver REDIRECT-TO-HTTPS
inservice
serverfarm host WLS11-7001
probe TCP7001_PROBE
rserver 228-WLS11host1 7001
inservice
rserver 229-WLS11host2 7001
inservice
sticky http-cookie ACE_COOKIE-7001 7001_STICKY
cookie insert browser-expire
replicate sticky
serverfarm WLS11-7001
action-list type modify http REWRITE
ssl url rewrite location "\acedemo.poweradvocate\.com"
ssl-proxy service WWW-PROD-SSLPROXY
key ProdKEYPAIR.PEM
cert WWW-PROD-CERT.crt
chaingroup WWW-PROD-CHAINGROUP
class-map type http loadbalance match-any L5
2 match http url /.*
class-map match-all WLS11-7001-CLASS
2 match virtual-address 192.168.211.50 tcp eq www
class-map match-all WLS11-HTTPS-CLASS
2 match virtual-address 192.168.211.50 tcp eq https
policy-map type loadbalance first-match HTTPS
class L5
sticky-serverfarm 7001_STICKY
action REWRITE
policy-map type loadbalance first-match WLS11-7001-Policy
class L5
serverfarm REDIRECT-SERVERFARM
policy-map multi-match WLS11-SLB
class WLS11-7001-CLASS
loadbalance vip inservice
loadbalance policy WLS11-7001-Policy
loadbalance vip icmp-reply active
nat dynamic 1 vlan 1000
class WLS11-HTTPS-CLASS
loadbalance vip inservice
loadbalance policy HTTPS
loadbalance vip icmp-reply active
nat dynamic 1 vlan 1000
ssl-proxy server WWW-PROD-SSLPROXY
interface vlan 1000
ip address 192.168.211.226 255.255.255.0
access-group input allow
nat-pool 1 192.168.211.50 192.168.211.50 netmask 255.255.255.255 pat
service-policy input WLS11-SLB
no shutdown
ip route 0.0.0.0 0.0.0.0 192.168.211.1
Thanks for any help you can provide!
-Andy
Solved! Go to Solution.
03-06-2013 09:31 PM
Andy,
I just saw your new post, I wish I would have seen it 10 hours before I would have suggested you the same my friend!
Anyway , any other request, Let us know!
Jorge
03-06-2013 08:46 PM
Well 10 hours later and I answered my own question. Here it is.
crypto chaingroup WWW-PROD-CHAINGROUP
cert AddTrustExternalCARoot.crt
cert COMODOHigh-AssuranceSecureServerCA.crt
access-list allow line 8 extended permit ip any any
probe icmp PROBE_SERVICE_ICMP
interval 5
passdetect interval 5
receive 5
probe tcp TCP7001_PROBE
port 7001
interval 5
passdetect interval 5
receive 3
connection term forced
open 2
rserver host 228-WLS11host1
ip address 192.168.211.228
inservice
rserver host 229-WLS11host2
ip address 192.168.211.229
inservice
rserver redirect REDIRECT-TO-HTTPS
webhost-redirection https://%h%p 301
inservice
serverfarm redirect REDIRECT-SERVERFARM
rserver REDIRECT-TO-HTTPS
inservice
serverfarm host WLS11-7001
probe TCP7001_PROBE
rserver 228-WLS11host1 7001
inservice
rserver 229-WLS11host2 7001
inservice
sticky http-cookie ACE_COOKIE-7001 7001_STICKY
cookie insert browser-expire
replicate sticky
serverfarm WLS11-7001
action-list type modify http REWRITE
ssl url rewrite location "\acedemo.poweradvocate\.com"
ssl-proxy service WWW-PROD-SSLPROXY
key ProdKEYPAIR.PEM
cert WWW-PROD-CERT.crt
chaingroup WWW-PROD-CHAINGROUP
class-map type http loadbalance match-any HTTP-MARKETING
2 match http url /index.html
class-map type http loadbalance match-any L5
2 match http url /.*
class-map match-all WLS11-7001-CLASS
2 match virtual-address 192.168.211.50 tcp eq www
class-map match-all WLS11-HTTPS-CLASS
2 match virtual-address 192.168.211.50 tcp eq https
policy-map type loadbalance first-match HTTPS
class L5
sticky-serverfarm 7001_STICKY
action REWRITE
policy-map type loadbalance first-match WLS11-7001-Policy
class HTTP-MARKETING
sticky-serverfarm 7001_STICKY
class L5
serverfarm REDIRECT-SERVERFARM
policy-map multi-match WLS11-SLB
class WLS11-7001-CLASS
loadbalance vip inservice
loadbalance policy WLS11-7001-Policy
loadbalance vip icmp-reply active
nat dynamic 1 vlan 1000
class WLS11-HTTPS-CLASS
loadbalance vip inservice
loadbalance policy HTTPS
loadbalance vip icmp-reply active
nat dynamic 1 vlan 1000
ssl-proxy server WWW-PROD-SSLPROXY
interface vlan 1000
ip address 192.168.211.226 255.255.255.0
access-group input allow
nat-pool 1 192.168.211.50 192.168.211.50 netmask 255.255.255.255 pat
service-policy input WLS11-SLB
no shutdown
ip route 0.0.0.0 0.0.0.0 192.168.211.1
Had to make a new class-map with a url match and then added that class to my existing http policy before my default policy. The new class in the http policy points straight to the serverfarm rather than hitting the https redirect.
Thanks!
-Andy
03-06-2013 09:31 PM
Andy,
I just saw your new post, I wish I would have seen it 10 hours before I would have suggested you the same my friend!
Anyway , any other request, Let us know!
Jorge
03-07-2013 09:04 AM
Thanks Jorge you have been more than helpful.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide