Buy or Renew
Buy or Renew
Cisco + Splunk: It’s a new day for your data. Learn more.
 
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
449
Views
0
Helpful
3
Replies

proceed only https and prevent any http on CSS

hassan_oudeh
Level 1
Level 1

‎09-18-2007 08:13 AM

I have to following config:

****************************

service SSL-EtradeTest

type ssl-accel

slot 2

keepalive type none

add ssl-proxy-list SSL_Proxy

compress enable

active

service WEB1

ip address 172.20.2.21

compress enable

slot 2

active

service WEB2

ip address 172.20.2.22

compress enable

slot 2

active

!*************************** OWNER ***************************

owner WEB

content SSL-Content

vip address 172.20.2.30

add service SSL-EtradeTest

protocol tcp

port 443

active

content WEB1-Content-HTTP1

vip address 172.20.2.30

add service WEB1

url "/HEN/pushlet/"

protocol tcp

port 9080

active

content WEB2-Content-HTTP1

vip address 172.20.2.30

add service WEB2

protocol tcp

port 80

url "/Trading/*" active

!*************************** GROUP ***************************

group WEB

vip address 172.20.2.30

add destination service WEB1

add destination service WEB2

active

CSS should not process http request send to it. It should process only

https requests.

Any idea please.....

Regards,

Hasan

Labels:
0 Helpful
3 Replies 3

Gilles Dufour
Cisco Employee
Cisco Employee

‎09-18-2007 10:04 AM

do a clause to deny http traffic on internet side vlan, and use the exclude command to not apply this clause to traffic from the SSL module.

See the following documentation about the exclude command.

http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/css11500series/v8.20/command/reference/CmdAclC.html#wp1139228

Gilles.

0 Helpful

hassan_oudeh
Level 1
Level 1
In response to Gilles Dufour

‎09-18-2007 12:16 PM

hi Gilles,

Thanks for response,

i was reading something about redirect the url http://www.name.com to https://www.name.com

is it possiible to do it in both ways ? if yes what is the differnce ??

Thanks,

Hasan

0 Helpful

Gilles Dufour
Cisco Employee
Cisco Employee
In response to hassan_oudeh

‎09-18-2007 11:10 PM

Hasan,

you can create a content rule for port 80 (HTTP) and use a redirect to send the traffic to HTTPS.

But you have to send your decrypted traffic to a different content rule : ie port 81.

However, if a user does a port scan and find port 81, it can bypass your HTTPS rule and access directly the port 81 content rule.

So at the end you will still need the ACL.

Gilles.

0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents