Forum Discussion

ndervishaj_8895's avatar
ndervishaj_8895
Icon for Nimbostratus rankNimbostratus
Nov 17, 2017

iRule to exclude network from further filtering and process the rest of the traffic by URI

Hi folks,

 

Complete noob to irules. What I am trying to achieve with this irule is to allow for a specific subnet access to any uri under the sun but restrict the rest of the world to only specific URI's.

 

when HTTP_REQUEST { if { [class match [IP::client_addr] equals vendor_network] } { pool vendorapp_https-8443_pool } elseif { [ class match [string tolower [HTTP::uri]] contains vendorapp_allowed_uri_list ] } { Stop processing the iRule for this event here return } else { drop } }

 

the page doesn't load and in cURL all I see is a successful SSL transaction (ssl offloaded).

 

I appreciate any input! Nick

 

application delivery
BIG-IP
iRules
security

1 Reply

Sort By
  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Nov 19, 2017

    first thing i would do is add some debug logging

     

    so log the IP::client_addr / HTTP::uri to make sure you are performing the right request

     

    then log for entering the different statements, so you know what the iRule felt about your request

     

    then tailf /var/log/ltm and do the request

     

    a quick check seems to indicate the second option doesn't have pick a specific pool, but that might be the standard one.

     

    see where that gets you.