World of EUC

2 content-switching policies:
1. To go to the LB vserver with the actual URL
2. Content-switching policies that catches all other paths, send it to a LB with a responder that does the redirect.
Technically, you could use a responder on the first LB to respond to all other request, but if you make a config error anything might be accessible as well. With a CS policy you are certain traffic never reaches the LB if it is not intended to be there.

What do you think about a CS policy like this HTTP.REQ.URL.SET_TEXT_MODE(IGNORECASE).CONTAINS("/pki/some.crl") and then a responder drop policy like this HTTP.REQ.URL.SET_TEXT_MODE(IGNORECASE).PATH.GET(1).EQ("some.crl").NOT

If the url starts with /pki/some.crl

Your GET(1) would return pki, so your responder would at least fail.

If /pki/some.crl is the exact url you want to allow, I’d set that to EQ() instead of CONTAINS()

But it depends if you are going the route with two lb vserver or not

Yes, thats correct and then I want to drop everything else. I have a set of netscalers on the inside as well, maybe good to go that way?

I’d to something like this:
```add lb vserver DEMO_VS_CRL HTTP 0.0.0.0 0 -persistenceType NONE -cltTimeout 180
add lb vserver DEMO_VS_REDIR_TO_CRL HTTP 0.0.0.0 0 -persistenceType NONE -cltTimeout 180
add cs action CSA_DEMO_VS_CRL -targetLBVserver DEMO_VS_CRL
add cs action CSA_DEMO_VS_REDIR_TO_CRL -targetLBVserver DEMO_VS_REDIR_TO_CRL
add cs policy CSP_DEMO_VS_CRL -rule "HTTP.REQ.URL.SET_TEXT_MODE(IGNORECASE).EQ(\"/pki/some.crl\")" -action CSA_DEMO_VS_CRL
add cs policy CSP_DEMO_VS_REDIR_TO_CRL -rule "HTTP.REQ.URL.SET_TEXT_MODE(IGNORECASE).EQ(\"/pki/some.crl\").NOT" -action CSA_DEMO_VS_REDIR_TO_CRL
add responder action RSA_DEMO_REDIR_TO_CRL redirect "\"/pki/some.crl\"" -responseStatusCode 302 -reasonPhrase "\"Found\""
add responder policy RSP_DEMO_REDIR_TO_CRL "HTTP.REQ.URL.SET_TEXT_MODE(IGNORECASE).EQ(\"/pki/some.crl\").NOT" RSA_DEMO_REDIR_TO_CRL
bind lb vserver DEMO_VS_REDIR_TO_CRL -policyName RSP_DEMO_REDIR_TO_CRL -priority 100 -gotoPriorityExpression END -type REQUEST```

then bind your CS policies to the applicable CS vserver

if the vserver is only used for that specific app, you could even use the default lb vserver and bind that to the DEMO_VS_CRL LB vserver so you don;t need the second CSP

Thank you VERY much! Yes the server is only intended for this. It's for publishing of a CRL obviously. :slightly_smiling_face: <http://comany.com/pki/some.crl>

i’d say, drop the second CSP (ending in .NOT)
Then set the default LB for the CS vserver to the LB DEMO_VS_REDIR_TO_CRL

As simple as possible! :slightly_smiling_face:

make sure the both LB vservers have a sevicegroup attached and are up :wink: