NetScaler is forcing the SSL connection on sites browsed with Secure Web

NetScaler is forcing the SSL connection on sites browsed with Secure Web

book

Article ID: CTX223086

calendar_today

Updated On:

Description

Web Links for HTTP resources attempting to connect (via Secure Web) over HTTPs and failing as resource does not exist on HTTPs

Resolution

- Create a pattern set to act as a whitelist of URLs that must always be http. 
- Create a Rewrite action on the local NetScaler to re-write the Location header being sent back to the client as part of the HTTP 302 response. 
- Create a Rewrite policy to target only Locations that match those within the pat-set. 
- Bind policy to the gateway vserver 

Problem Cause

This issue appears under the following circumstances

- On-prem NetScaler in place for gateway connections
- Hosted NetScaler for XenMobile LB and CS.
- Web Links for HTTP sites.

The Content Switch on the hosted NetScaler as "SSL Redirect" enabled by default

Additional Information

Example config ...

add policy patset url_whitelist
bind policy patset url_whitelist website.domain.com -index 1 -charset UTF_8
add rewrite action url_whitelist_rw_action replace "http.RES.HEADER(\"Location\").REGEX_SELECT(re!https!)" "\"http\""
add rewrite policy http_whitelist_rw "http.RES.HEADER(\"Location\").CONTAINS_ANY(\"url_whitelist\")" url_whitelist_rw_action