iRules

19419 Topics

Configure syslog server in F5 with an irule to see actual internet IP in syslog server
Hi, we are using Big IP 3900 version 10.2 , We had network topolgy in this way that we need to enable SNAT as AutoMap , For this reason we are not been able to see the actual Internet IP / Client IP , in the servers . We want configure an irule in such a way that it will log the actual Internet/Client IP and send it to the syslog server . For that should we need to configure syslog server in F5 , or it can be configured or forward through irule itself. Our mail Aim is to see only the Actual Internet/Client IP. Please help Thanks in Advance for the help
krishans_52349 Jan 25, 2011 Place Technical Forum
9.1KViews
0likes
22Comments
URL rewrite through iRule
Hi Guys, i have one "Performance (HTTP)" virtual server on F5-1600 series, and i want to change the URL "http://www.abc.com" to "http://partner.abc.com/xyz". i have tried all below scripts : 1- when HTTP_REQUEST { if {([string tolower [HTTP::host]] equals "http://www.abc.com")}{ HTTP::header replace Host "http://partner.abc.com/xyz" } } 2- when HTTP_REQUEST { if { not ([HTTP::uri] starts_with "/xyz") } { HTTP::uri /xyz[HTTP::uri] } } 3- when HTTP_REQUEST { if {[HTTP::uri] equals {http://www.abc.com}} {HTTP::uri {http://partner.abc.com/xyz} } } but i wasn't successful! can anyone help me how can i do this through iRule ?
Solved
sunnyman67_1367 Nov 03, 2013 Place Technical Forum
8.4KViews
0likes
27Comments
Adding CORS response headers
Hey all, There are a number of other older (2013-era) threads about CORS headers, and I want to ask a specific question which has not been asked there: Can I add a response header using HTTP::header insert within an HTTP_REQUEST? In at least one CORS-related thread (https://devcentral.f5.com/questions/cors-irule-query), this is shown happening. However, in another thread (https://devcentral.f5.com/questions/access-control-allow-origin-on-f5) the answer includes code in the HTTP_REQUEST to set a variable and then in the HTTP_RESPONSE, a check is made on that variable and if it is set, the HTTP::header insert is used. Basically, I want to include all my CORS-related code in one place. Currently, I am doing basic CORS (adding the ACAO header for GET/POST requests from my domain where the Origin request header is present) using my CDN (Akamai) and I have this iRule for CORS preflight responses: when HTTP_REQUEST { if { ( [HTTP::method] equals "OPTIONS" ) and ( [HTTP::host] contains "mysite.com"] ) and ( [HTTP::header] exists "Access-Control-Request-Method") } { HTTP::respond 200 Access-Control-Allow-Origin "[HTTP::header Origin]" \ Access-Control-Allow-Methods "POST, GET, OPTIONS" \ Access-Control-Allow-Headers "[HTTP::header Access-Control-Request-Headers]" \ Access-Control-Max-Age "86400" return } } However, for simplification, I want to put all the CORS stuff (basic and preflight) in the iRule. So my question is, will this work: when HTTP_REQUEST { CORS preflight OPTIONS requests if { ( [HTTP::method] equals "OPTIONS" ) and ( [HTTP::host] contains "mysite.com"] ) and ( [HTTP::header] exists "Access-Control-Request-Method") } { HTTP::respond 200 Access-Control-Allow-Origin "[HTTP::header Origin]" \ Access-Control-Allow-Methods "POST, GET, OPTIONS" \ Access-Control-Allow-Headers "[HTTP::header Access-Control-Request-Headers]" \ Access-Control-Max-Age "86400" return } CORS GET/POST requests if { ( [HTTP::method] equals "GET" or [HTTP::method] equals "POST") and ( [HTTP::host] contains "mysite.com"] ) and ( [HTTP::header] exists "Origin") } { HTTP::header insert Access-Control-Allow-Origin "[HTTP::header Origin]" } } or do I need this: when HTTP_REQUEST { CORS preflight OPTIONS requests if { ( [HTTP::method] equals "OPTIONS" ) and ( [HTTP::host] contains "mysite.com"] ) and ( [HTTP::header] exists "Access-Control-Request-Method") } { HTTP::respond 200 Access-Control-Allow-Origin "[HTTP::header Origin]" \ Access-Control-Allow-Methods "POST, GET, OPTIONS" \ Access-Control-Allow-Headers "[HTTP::header Access-Control-Request-Headers]" \ Access-Control-Max-Age "86400" return } CORS GET/POST requests if { ( [HTTP::host] contains "mysite.com"] ) and ( [HTTP::header] exists "Origin") } { set cors_origin [HTTP::header Origin] } } when HTTP_RESPONSE { CORS GET/POST response - check variable set in request if { [info exists cors_origin] } { HTTP::header insert Access-Control-Allow-Origin $cors_origin } } Does this make sense, or am I getting too complex?
Solved
Rory_Hewitt_F5_Jul 10, 2015 Place Technical Forum
7.9KViews
0likes
13Comments
SSL errno 104 through F5 (vip), directly with curl ok
Hello community, I've the following configuration design within a virtual server configuration: - A virtual server will route the traffic based on the hostname within the request to different pools. - Client- and server SSL are enabled - The routing will been done with LTM policys instead of iRules. - There are five backend systems which should be accessible over the vs - SNAT is enabled Now, the problem is that from the five backends are only three backend systems are accessible. The other two systems don't work. Within the LTM policy I've additional enabled the "log" option to make sure that the routing will work. To find out what is going wrong, I've executed a curl and openssl query direct to the backend system from the F5 console. Connection can be established and I receive the 200 status code. If I do the same over the VIP of the configuration I receive the following error code: read:errno=104 These are my teststrings: openssl s_client -connect vip:443 GET /dialin/ HTTP/1.1 Host: lyncpool1 or 2 or 3 ... With lyncpool1 as the value for the host it will work and with lyncpool2 I receive the error code from above. The client SSL settings from the vip will been displayed. It seams that there is an issue/problem while talking SSL with the backend system which will not work. If I do the same with the original IP of the system instead of the VIP, each system are working fine. Have anybody an idea? I've just readed some threads within devcentral to similar problems but nothing helped my until now. Regards seilemor
seilemor_131269 Aug 29, 2016 Place Technical Forum
7.1KViews
0likes
20Comments
iRule to change host headers.
Hi guys, first time on DC so apologies in advance if I'm doing something wrong. Please can you help with an issue I have. We have a website that is hosted externally on a server which hosts multiple websites. There is a requirement to SSL enable the communication to our website on this particular server. The web server hosting these multiple sites performs SSL but can't host a certificate for our website/domain. We're therefore changing the access model for this site so that the we perform Client SSL and Server SSL on the BIG-IP obviously hosting the cert for our domain on the BIG-IP. However, it looks like there is an issue when the BIG-IP sends the request to the server, in that, the server sends a reset. For example, hosted site of https://www.hosted.com/aon.asp. However, we want clients to reach https://www.mybigip.com, which would (as per the name) resolve to the VIP on our BIG-IP which would in turn load-balance to the IP of the hosted dom. I imagine we'll need to modify host headers using an iRule to when the HTTP request is made, but I'm not sure if I'll need to change the host headers on the way back in the HTTP response. Any help greatly appreciated. cheers, Steve.
Stephen_Swali_8 Jan 17, 2008 Place Technical Forum
6.7KViews
0likes
11Comments
Redirect to different Pool based on URL
Redirect to different Pool based on URL I have 1 VIP and want to re-direct to different pool depending on the url. abppv1-ui-qa2.apple.com:8443 should go to Pool1 abpp-notif-qa.am.tsacorp.com:8443 should go to Pool2 I tried below iRule but it did not work. Any help would be highly appreciated. when HTTP_REQUEST { if { [HTTP::path] contains "abppv1-ui-qa2" } { pool Pool1 } elseif { [HTTP::path] contains "abpp-notif-qa" } { pool Pool2 } }
Solved
Atee_354939 May 16, 2018 Place Technical Forum
6.5KViews
0likes
8Comments
View persistence table data
Is there a command available to view the data held in the persistence table for LTM v11.2.1? I have recently switched from using a persistence profile that affected all traffic to the VIP to an irule that only sets persistence if the URI matches a key word. After this change it appears that not all connections are getting persistence set.
Solved
Philip_King_719 Mar 17, 2014 Place Technical Forum
6KViews
0likes
9Comments
Help with iRule logging to local0.
I am trying to log an iRule, but it keeps erroring out. Can you help with what I'm missing? when HTTP_REQUEST { if { [HTTP::path] starts_with "/media" } { pool persist cookie insert log local0. ”media.com_28080 TCP_logging fired, from [IP::client_addr]" } }
benniehanas_239 Mar 14, 2018 Place Technical Forum
5.8KViews
0likes
9Comments
How to check the support id.
Hi Guys, I am new for F5. Dome times users can able to access our clients network from outside. User provides us a support id. Now my query is how to check this support id in LTM and allow that URL so that user's can able to access the URL.Kindly help me to fix issue. Please tell me the steps. Regards Tan_Sal
Tan_Sal_137877 Nov 17, 2013 Place Technical Forum
5.6KViews
0likes
12Comments
RabbitMQ and AMQP Proxy
I was wondering if someone has successfully deployed an F5 application that proxies the AMQP messages for RabbitMQ on port 5672. I was hoping for some help with an iRule.
Solved
AlexLP_236549 Oct 10, 2018 Place Technical Forum
5.6KViews
0likes
6Comments