proceed only https and prevent any http on CSS

[hassan_oudeh]

I have to following config:

****************************

service SSL-EtradeTest

type ssl-accel

slot 2

keepalive type none

add ssl-proxy-list SSL_Proxy

compress enable

active

service WEB1

ip address 172.20.2.21

compress enable

slot 2

active

service WEB2

ip address 172.20.2.22

compress enable

slot 2

active

!*************************** OWNER ***************************

owner WEB

content SSL-Content

vip address 172.20.2.30

add service SSL-EtradeTest

protocol tcp

port 443

active

content WEB1-Content-HTTP1

vip address 172.20.2.30

add service WEB1

url "/HEN/pushlet/"

protocol tcp

port 9080

active

content WEB2-Content-HTTP1

vip address 172.20.2.30

add service WEB2

protocol tcp

port 80

url "/Trading/*" active

!*************************** GROUP ***************************

group WEB

vip address 172.20.2.30

add destination service WEB1

add destination service WEB2

active

CSS should not process http request send to it. It should process only

https requests.

Any idea please.....

Regards,

Hasan

[Gilles Dufour]

do a clause to deny http traffic on internet side vlan, and use the exclude command to not apply this clause to traffic from the SSL module.

See the following documentation about the exclude command.

http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/css11500series/v8.20/command/reference/CmdAclC.html#wp1139228

Gilles.

[hassan_oudeh]

hi Gilles,

Thanks for response,

i was reading something about redirect the url http://www.name.com to https://www.name.com

is it possiible to do it in both ways ? if yes what is the differnce ??

Thanks,

Hasan

[Gilles Dufour]

Hasan,

you can create a content rule for port 80 (HTTP) and use a redirect to send the traffic to HTTPS.

But you have to send your decrypted traffic to a different content rule : ie port 81.

However, if a user does a port scan and find port 81, it can bypass your HTTPS rule and access directly the port 81 content rule.

So at the end you will still need the ACL.

Gilles.