Combining layer 3/4 and layer 7 filtering

Question

Hi.
The configuration below is extracted from a working configuration where the ACE is doing SSL offload for a web service - this is pretty standard stuff.
What I have been asked to do is modify the configuration so that:
1) Any connections from an internal source (this will be the 10.0.0/8 and 17.16.0.0/16 range of IP's) can continue to access any URL.
2) Any other connections - which will be from an external source - are only allowed to access URL's beginning with /public and /downloads.
Can you please advise me on how to change this?  If necessary, I can define a second VIP for the external connections and setup the DNS appropriately.
Thanks in advance
crypto chaingroup WEBSERVER_CHAIN
  cert WEBSERVER.CER
  cert VERISIGN.CER
probe tcp WEBSERVER
  port 7777
ssl-proxy service SSL_PROXY_WEBSERVER
  key WEBSERVER.KEY
  cert WEBSERVER.CER
  chaingroup WEBSERVER_CHAIN
serverfarm host WEBSERVER
  probe WEBSERVER
  rserver SERVER1 7777
    inservice
  rserver SERVER2 7777
    inservice
sticky http-cookie WEBSERVER_COOKIE WEBSERVER_StickyGroup
  cookie insert browser-expire
  replicate sticky
  serverfarm WEBSERVER
class-map match-all WEBSERVER
  10 match virtual-address 172.16.16.1 tcp eq https
policy-map type loadbalance first-match WEBSERVER_L7
  class class-default
    sticky-serverfarm WEBSERVER_StickyGroup
policy-map multi-match GlobalLB
class WEBSERVER
    loadbalance vip inservice
    loadbalance policy WEBSERVER_L7
    loadbalance vip icmp-reply
    ssl-proxy server SSL_PROXY_WEBSERVER

Answer 1

first make class maps to characterize the traffic:
class-map type http loadbalance match-all ten
  2 match source-address 10.0.0.0 255.0.0.0
  4 match http url .*
class-map type http loadbalance match-all seventeen
  2 match source-address 17.16.0.0 255.255.0.0
  4 match http url .*
class-map type http loadbalance match-any restrict
  2 match http url /public.*
  4 match http url /downloads.*
then use in load balance policy as follows:
policy-map type loadbalance first-match WEBSERVER_L7
class ten
sticky-serverfarm WEBSERVER_StickyGroup
class seventeen
sticky-serverfarm WEBSERVER_StickyGroup
class restrict
sticky-serverfarm WEBSERVER_StickyGroup
if you want to send outside users with other urls to a sorry page you would have a server in a serverfarm taht would do that and use it in a class class-default on the bottom of the load balance policy. The matches on load balance policy are top down so order is important.