cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
757
Views
0
Helpful
3
Replies

Match Url to Avoid SSL

Hi Guys,

I want to exclude on specific site from SSL. I know I need to do a URL match for this but I can for the life of me figure it out.

The url is acedemo.poweradvocate.com/index.html currently this is redirected to https like all my other url's/

Here is my config.

crypto chaingroup WWW-PROD-CHAINGROUP

  cert AddTrustExternalCARoot.crt

  cert COMODOHigh-AssuranceSecureServerCA.crt

access-list allow line 8 extended permit ip any any

probe icmp PROBE_SERVICE_ICMP

  interval 5

  passdetect interval 5

  receive 5

probe tcp TCP7001_PROBE

  port 7001

  interval 5

  passdetect interval 5

  receive 3

  connection term forced

  open 2

rserver host 228-WLS11host1

  ip address 192.168.211.228

  inservice

rserver host 229-WLS11host2

  ip address 192.168.211.229

  inservice

rserver redirect REDIRECT-TO-HTTPS

  webhost-redirection https://%h%p 301

  inservice

serverfarm redirect REDIRECT-SERVERFARM

  rserver REDIRECT-TO-HTTPS

    inservice

serverfarm host WLS11-7001

  probe TCP7001_PROBE

  rserver 228-WLS11host1 7001

    inservice

  rserver 229-WLS11host2 7001

    inservice

sticky http-cookie ACE_COOKIE-7001 7001_STICKY

  cookie insert browser-expire

  replicate sticky

  serverfarm WLS11-7001

action-list type modify http REWRITE

  ssl url rewrite location "\acedemo.poweradvocate\.com"

ssl-proxy service WWW-PROD-SSLPROXY

  key ProdKEYPAIR.PEM

  cert WWW-PROD-CERT.crt

  chaingroup WWW-PROD-CHAINGROUP

class-map type http loadbalance match-any L5

  2 match http url /.*

class-map match-all WLS11-7001-CLASS

  2 match virtual-address 192.168.211.50 tcp eq www

class-map match-all WLS11-HTTPS-CLASS

  2 match virtual-address 192.168.211.50 tcp eq https

policy-map type loadbalance first-match HTTPS

  class L5

    sticky-serverfarm 7001_STICKY

    action REWRITE

policy-map type loadbalance first-match WLS11-7001-Policy

  class L5

    serverfarm REDIRECT-SERVERFARM

policy-map multi-match WLS11-SLB

  class WLS11-7001-CLASS

    loadbalance vip inservice

    loadbalance policy WLS11-7001-Policy

    loadbalance vip icmp-reply active

    nat dynamic 1 vlan 1000

  class WLS11-HTTPS-CLASS

    loadbalance vip inservice

    loadbalance policy HTTPS

    loadbalance vip icmp-reply active

    nat dynamic 1 vlan 1000

    ssl-proxy server WWW-PROD-SSLPROXY

interface vlan 1000

  ip address 192.168.211.226 255.255.255.0

  access-group input allow

  nat-pool 1 192.168.211.50 192.168.211.50 netmask 255.255.255.255 pat

  service-policy input WLS11-SLB

  no shutdown

ip route 0.0.0.0 0.0.0.0 192.168.211.1

Thanks for any help you can provide!

-Andy

1 Accepted Solution

Accepted Solutions

Jorge Bejarano
Level 4
Level 4

Andy,

I just saw your new post, I wish I would have seen it 10 hours before I would have suggested you the same my friend!

Anyway , any other request, Let us know!

Jorge

View solution in original post

3 Replies 3

Well 10 hours later and I answered my own question. Here it is.

crypto chaingroup WWW-PROD-CHAINGROUP

  cert AddTrustExternalCARoot.crt

  cert COMODOHigh-AssuranceSecureServerCA.crt

access-list allow line 8 extended permit ip any any

probe icmp PROBE_SERVICE_ICMP

  interval 5

  passdetect interval 5

  receive 5

probe tcp TCP7001_PROBE

  port 7001

  interval 5

  passdetect interval 5

  receive 3

  connection term forced

  open 2

rserver host 228-WLS11host1

  ip address 192.168.211.228

  inservice

rserver host 229-WLS11host2

  ip address 192.168.211.229

  inservice

rserver redirect REDIRECT-TO-HTTPS

  webhost-redirection https://%h%p 301

  inservice

serverfarm redirect REDIRECT-SERVERFARM

  rserver REDIRECT-TO-HTTPS

    inservice

serverfarm host WLS11-7001

  probe TCP7001_PROBE

  rserver 228-WLS11host1 7001

    inservice

  rserver 229-WLS11host2 7001

    inservice

sticky http-cookie ACE_COOKIE-7001 7001_STICKY

  cookie insert browser-expire

  replicate sticky

  serverfarm WLS11-7001

action-list type modify http REWRITE

  ssl url rewrite location "\acedemo.poweradvocate\.com"

ssl-proxy service WWW-PROD-SSLPROXY

  key ProdKEYPAIR.PEM

  cert WWW-PROD-CERT.crt

  chaingroup WWW-PROD-CHAINGROUP

class-map type http loadbalance match-any HTTP-MARKETING

  2 match http url /index.html

class-map type http loadbalance match-any L5

  2 match http url /.*

class-map match-all WLS11-7001-CLASS

  2 match virtual-address 192.168.211.50 tcp eq www

class-map match-all WLS11-HTTPS-CLASS

  2 match virtual-address 192.168.211.50 tcp eq https

policy-map type loadbalance first-match HTTPS

  class L5

    sticky-serverfarm 7001_STICKY

    action REWRITE

policy-map type loadbalance first-match WLS11-7001-Policy

  class HTTP-MARKETING

    sticky-serverfarm 7001_STICKY

  class L5

    serverfarm REDIRECT-SERVERFARM

policy-map multi-match WLS11-SLB

  class WLS11-7001-CLASS

    loadbalance vip inservice

    loadbalance policy WLS11-7001-Policy

    loadbalance vip icmp-reply active

    nat dynamic 1 vlan 1000

  class WLS11-HTTPS-CLASS

    loadbalance vip inservice

    loadbalance policy HTTPS

    loadbalance vip icmp-reply active

    nat dynamic 1 vlan 1000

    ssl-proxy server WWW-PROD-SSLPROXY

interface vlan 1000

  ip address 192.168.211.226 255.255.255.0

  access-group input allow

  nat-pool 1 192.168.211.50 192.168.211.50 netmask 255.255.255.255 pat

  service-policy input WLS11-SLB

  no shutdown

ip route 0.0.0.0 0.0.0.0 192.168.211.1

Had to make a new class-map with a url match and then added that class to my existing http policy before my default policy.  The new class in the http policy points straight to the serverfarm rather than hitting the https redirect.

Thanks!

-Andy

Jorge Bejarano
Level 4
Level 4

Andy,

I just saw your new post, I wish I would have seen it 10 hours before I would have suggested you the same my friend!

Anyway , any other request, Let us know!

Jorge

Thanks Jorge you have been more than helpful.

Review Cisco Networking for a $25 gift card