Showing results for 
Search instead for 
Did you mean: 

SSL URL Rewrite with wildcard on ACE




When doing SSL termination on ACE, there are times when the rserver  might not have knowledge that the client only see https and would send a  HTTP redirect with a http link (instead of https). This would  inadvertently cause the client to leave the encypted session. It's  possible to have ACE rewrite the http link to https. This document shows  an example configuration to achieve the ACE SSL URL rewrite functionality.

client browser---------https--------ACE-------http---------rserver

In the following example, the rserver would send a HTTP 301 redirect with link, and the ACE would rewrite the link to




The configuration shown in this document is created on ACE 4710 Appliance running A3(2.5) version software.

For the ACE module URL rewrite is supported on version c6ace-t1k9-mz.A2_1.bin or later. Remember that both ACE will need to have certificates and keys.


Key Config


The key configuration is under the "action-list" command. The following commands to rewrite to


action-list type modify http SSL_URL_REWRITE
ssl url rewrite location "foo2\.bar\..*"


Note, the use of wildcard with .*

This would rewrite to

or to

or to etc...


Two dots is needed for the wildard to work. The "\." (escape  character \ and .) means to match a dot. Then ".*" means wildcard (zero or  more of any character).


For the list a list of the supported characters ACE use in  regular expressions. Please see "Special Characters for Matching String  Expressions" in the following link:


Detail Configuration


access-list INBOUND line 8 extended permit ip any any

parameter-map type http PERSISTENCE-REBALANCE

\\define the rserver host
rserver host SERVER1
 ip address

\\as mentioned above in Key Config section
action-list type modify http SSL_URL_REWRITE
 ssl url rewrite location "foo2\.bar\"

\\define serverfarm with the rserver
serverfarm host HTTP-SFARM
 rserver SERVER1 80

ssl-proxy service TEST-CERT
 key simon.key
 cert simon.crt

\\select the address of the server defined in serverfarm
sticky ip-netmask address source SOURCEIP-STICKY-HTTP-SFARM
 replicate sticky
 serverfarm HTTP-SFARM

\\class map to match SSL traffic to VIP address
class-map match-all SSL-VIP
 2 match virtual-address tcp eq https

\\class map to match management traffic
class-map type management match-any remote_access
 202 match protocol icmp any
 204 match protocol ssh any
 207 match protocol snmp any
 208 match protocol telnet any
 209 match protocol http any
 210 match protocol https any
 211 match protocol xml-https any

\\policy map to permit traffic matched by remote_access class
policy-map type management first-match management
 class remote_access

\\policy map to do ssl url rewrite on serverfarm address selected
policy-map type loadbalance first-match LB-L7-POLICY
 class class-default
   sticky-serverfarm SOURCEIP-STICKY-HTTP-SFARM

\\policy map to define action on traffic matched by SSL-VIP class
policy-map multi-match LB-L4-POLICY
 class SSL-VIP
   loadbalance vip inservice
   loadbalance policy LB-L7-POLICY
   loadbalance vip icmp-reply
   nat dynamic 1 vlan 805
   appl-parameter http advanced-options PERSISTENCE-REBALANCE
   ssl-proxy server TEST-CERT

interface vlan 805
 description "Client Side"
 ip address
 peer ip address
 access-group input INBOUND
 nat-pool 1 netmask
 service-policy input management
 service-policy input LB-L4-POLICY
 no shutdown

ip route 


The above configuration should work fine for URL rewrite, in case you need URL redirection configure following.


rserver redirect url1

  webhost-redirection  302



You can just configure rserver redirect and call this server in serverfarm. Configure a policy map as shown above and also associate SSL proxy with the corresponding class under policy map.You main URL should come to a VIP specified in class Test and then it will be LB to serverfarm and should be redirected since SSL offloading is there in place.


Related information


ACE behavior with static sticky and rserver down situation

Deploying GSS and ACE in least loaded GSLB based on VIP conn number

Configure ACE with SSL Termination and URL Rewrite

Content for Community-Ad