SonicOS 7 System

Technical Documentation > SonicOS 7 System > Interfaces > About Interfaces > HTTP/HTTPS Redirection

HTTP/HTTPS Redirection

HTTP/HTTPS Redirection with DP Offload

When the security appliance configuration requires user authentication, HTTP/HTTPS traffic from an unauthenticated source is redirected to the SonicOS login screen for the user to enter their credentials. A problem occurs when HTTP and HTTPS traffic arrive from sources from which users do not log in, and one or more such sources repeatedly try to open new connections, which keeps triggering this redirection. These could be non-user devices that are validly trying to get access or could be malicious code attempting a Denial of Service (DoS) attack. The effect that it has on the Security Appliance is to cause high CPU load in the CP, both in the data plane task initiating the redirections and in the web server thread tasks that are serving up the target redirect pages.

To minimize this effect, ensure the Add rule to enable redirect from HTTP to HTTPS option is selected when adding or editing an interface. Enabling this option causes SonicOS to add an access rule that allows HTTP to the interface; a side effect of this rule is that it also allows SonicOS to be able to redirect HTTPS to HTTP in certain cases without security issues. One such case is the first step of redirecting traffic that needs to be authenticated, at which point there is no sensitive data that needs to be hidden. Then HTTP processing can occur on the data plane (DP) rather than on the CP.

This option is not available when adding or editing VPN tunnel interfaces or when Wire Mode (2-Port Wire), Tap Mode (1-Port Tap), or PortShield Switch Mode is selected for Mode/IP Assignment.

< Previous Section Next Section >

Was This Article Helpful?

Help us to improve our support portal

Yes! Not Really

SonicOS 7 System

HTTP/HTTPS Redirection

Was This Article Helpful?

Techdocs Article Helpful form

Techdocs Article NOT Helpful form

Stay In Touch