iRule assistance - Block SSL/TLS unless client already has an existing session

Hi,

First, change the question title, I read only today the question because of the title.

I think iRule assistance and iRule help titles are questions less read.

can you please describe your need. if you have an irule working and you want to change the behavior, share it!

then try to explain what you expect with simple sentences and examples.

when I read your description, you want to block SSL handshake for new session, and allow only handshake for existing sessions. This code will block all new requests as SSL handshake is done first.

Hi,

I guess HTTPS logon page and TLS services are on different VS. If not, it will be more difficult because you will have to capture TCP packet first, decode it to parse binary content.

You can create a table record with the IP address in irule assigned to APM virtual server:

when ACCESS_POLICY_COMPLETED {
    if {[ACCESS::policy result] equals "allow"} 
        table set -subtable L4SESSION [IP::client_addr] [ ACCESS::session sid ] [PROFILE::access inactivity_timeout] [PROFILE::access max_session_timeout]
    }
}

when ACCESS_SESSION_CLOSED {
    table delete -subtable L4SESSION [IP::client_addr]
}

Then accept connection on other VS if IP address is known

when CLIENT_ACCEPTED {
    if {[table lookup -subtable L4SESSION [IP::client_addr]] equals ""} {
        drop
    }
}