Forum Discussion

flipperfil's avatar
flipperfil
Icon for Nimbostratus rankNimbostratus
Dec 17, 2014

Adding networks with switch [IP::client_addr]

I currently have an irule that looks for specific host entries or defaults to .... I am trying to incorporate rfc1918 networks statements example "10.0.0.0/8" - and this doesn't work. This is on v11.4.1.

 

when HTTP_REQUEST { switch [IP::client_addr] { "a.a.a.a" - "b.b.b.b" { return

 

} default { HTTP::header insert X-NOKERB X-NOKERB } } }

 

I have been trying other syntax but can't seem to get it right. Any help would be appreciated:

 

if { ([IP::client_addr] equals 10.0.0.0/8) || ([IP::client_addr] equals a.a.a.a) } then { return

 

} else { HTTP::header insert X-NOKERB X-NOKERB }

 

application delivery
BIG-IP Access Policy Manager (APM)
deployment
devops
iRules
LTM
security
  • Sheigh_65772's avatar
    Sheigh_65772
    Icon for Cirrus rankCirrus
    Dec 17, 2014

    Found this commented out in one of my iRule, give it a try

    if { [IP::addr [IP::client_addr] equals 10.x.x.0/24] }

  • flipperfil's avatar
    flipperfil
    Icon for Nimbostratus rankNimbostratus
    Dec 18, 2014

    I cant seem to get it to work with supernets:

     

    01070151:3: Rule [/Common/IDS_IRULE_HEADER_INSERT] error: /Common/IDS_IRULE_HEADER_INSERT:1: error: [command is not valid in the current scope][if { [IP::addr [IP::client_addr] equals 10.0.0.0/8] } { return } elseif { [IP::addr [IP::client_addr] equals 172.16.0.0/12] } { return } else { HTTP::header insert X-NOKERB X-NOKERB }]

     

    if { [IP::addr [IP::client_addr] equals 10.0.0.0/8] } { return

     

    } elseif { [IP::addr [IP::client_addr] equals 172.16.0.0/12] } { return

     

    } else { HTTP::header insert X-NOKERB X-NOKERB }

     

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Dec 20, 2014

    it looks okay to me.

    root@(B11050-R72-S12)(cfg-sync Standalone)(Active)(/Common)(tmos) list ltm rule qux
ltm rule qux {
    when HTTP_REQUEST {
  if { [IP::addr [IP::client_addr] equals 10.0.0.0/8] } {
    return
  } elseif { [IP::addr [IP::client_addr] equals 172.16.0.0/12] } {
    return
  } else {
    HTTP::header insert X-NOKERB X-NOKERB
  }
}
}