cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
520
Views
0
Helpful
1
Replies

Same content rule for port 80 and 443

rlortiz
Level 1
Level 1

I have a site that needs to have 1 content rule for both port 80 and port 443. Presently, we are using more than one server for both rules. Is there a way to setup one content rule for 2 ports? The reason behind this is the desire to have both port 80 and port 443 use the same server.

Here is the example config using 2 rules with more than 1 server, but would rather have one rule:

owner Trixone

content trixone-bst-443

protocol tcp

port 443

vip address xx.xx.xx.xx

add service fdevap1-8251

add service fdevap2-8251

balance aca

arrowpoint-cookie path "/"

sticky-inact-timeout 120

no persistent

application ssl

advanced-balance ssl

active

content trixone-bst-80

protocol tcp

port 80

vip address xx.xx.xx.xx

add service fdevap1-8250

add service fdevap2-8250

balance aca

advanced-balance arrowpoint-cookie

arrowpoint-cookie path "/"

sticky-inact-timeout 120

no persistent

active

content trixone-bst-w-443

protocol tcp

port 443

vip address xx.xx.xx.xx

add service fdevap1-7253

add service fdevap1-7255

add service fdevap1-7257

add service fdevap1-7259

add service fdevap2-7253

add service fdevap2-7255

add service fdevap2-7257

add service fdevap2-7259

balance aca

application ssl

arrowpoint-cookie path "/"

sticky-inact-timeout 120

advanced-balance ssl

no persistent

active

content trixone-bst-w-80

protocol tcp

port 80

vip address xx.xx.xx.xx

add service fdevap1-7252

add service fdevap1-7254

add service fdevap1-7256

add service fdevap1-7258

add service fdevap2-7252

add service fdevap2-7254

add service fdevap2-7256

add service fdevap2-7258

balance aca

advanced-balance arrowpoint-cookie

arrowpoint-cookie path "/"

sticky-inact-timeout 120

no persistent

active

Any help would be appreciated.

1 Reply 1

Gilles Dufour
Cisco Employee
Cisco Employee

replace the existing rules with one that does not specify the port [L3 rule].

However, you can't use arrowpoint cookie anymore.

And you can't use 'advanced-balance ssl'.

Another solution would be to use an SSL offloader to decrypt the traffic and have the cookie inserted in the https traffic as well.

Regards,

Gilles.

Review Cisco Networking for a $25 gift card