APM ActiveSync - Block or Allow DeviceID

Hello,

I'm setting up a F5 APM with ActiveSync. ActiveSync is working fine. But to add some extra security i want to allow devices by their DeviceID I followed the document "Enhancing Exchange Mobile Device Security with the F5 BIG-IP Platform" Section: "Device Validation Methode 1 - Organization Device Pool"

Step 1: Create a Data Group List (devices) that includes all relevant device IDs Step 2: F5 IRule when HTTP_REQUEST {

Apply DeviceID restriction to all ActiveSync directory traffic if {[HTTP::path] == "/Microsoft-Server-Activesync"} {

 Determine whether connection is Base64 encoded, (Windows Phone) and if necessary begin decoding process
set string_b64encoded [HTTP::query]
if {[catch {b64decode $string_b64encoded} string_b64decoded] == 0 and $string_b64decoded ne ""} {
  log local0.info "Successful login with deviceID: "
  binary scan $string_b64decoded x4H2 IDlenHEX
  scan $IDlenHEX %x IDlenDEC
  set IDlen {expr "$IDlenDEC * 2"}
  binary scan $string_b64decoded x5H$IDlen HEXdeviceID
  set string_sentid [string toupper $HEXdeviceID]
} else {
  set string_sentid [string toupper [URI::query [HTTP::uri]]]
}

log local0.info "String b64decoded = $string_b64decoded"

 compare deviceID presented in HTTP::query with BigIP Data Group List - 'devices'
if {[matchclass $string_sentid contains devices]} {
  log local0.info "Successful login with deviceID: $string_sentid"
} else {
  log local0.info "Failed login with deviceID: $string_sentid"

}

} }

Step 3 Add iRule to the virtual server

No mather what ID i add to the data group it is not working . Every device can access activesync. Can anyone help me with this.