Forum Discussion
NimbostratusAPM error when browsing to IP vs FQDN
I am looking for anyone that can pass along any documentation or info regarding how to configure my policy to allow browsing to IP address instead of FQDN. Currently I am able to browse to both of my host VS testa.comp.com and testb.comp.com. When i try to browse to http://1.2.3.4 or http://1.2.3.5 I am now failing somewhere in my policy flow but can not tell where. I am prompted with the logout page and generic error message that my session could not be established. I have pulled the log files for the APM and can see that I am stopping after a new session is created. But when I use the FQDN I see the request go in to the "Access Policy Processor"
This is where i stop browsing via IP address.
Feb 13 07:34:09 tmm notice tmm[18622]: 01490500:5: 8fce7356: New session from client IP 1.2.3.1 (ST=/CC=US/C=NA) at VIP 1.2.3.4 Listener /Common/test-client_auth_vs
This is what i see when permission is granted.
Feb 13 07:34:35 tmm notice tmm[18622]: 01490500:5: 9d27725f: New session from client IP 1.2.3.1 (ST=/CC=US/C=NA) at VIP 1.2.3.4 Listener /Common/test-client_auth_vs
Feb 13 07:34:55 a-f5 err apd[9038]: 01490000:3: AccessPolicyProcessor/AccessPolicyProcessor.cpp func: "evaluateExpression()" line: 432 Msg: failed to eval rule: invalid command name "1.2.3.4"
Feb 13 07:34:55 a-f5 err apd[9038]: 01490000:3: AccessPolicyProcessor/AccessPolicyProcessor.cpp func: "evaluateExpression()" line: 432 Msg: failed to eval rule: invalid command name "1.2.3.5"
Feb 13 07:34:55 a-f5 err apd[9038]: 01490000:3: AccessPolicyProcessor/AccessPolicyProcessor.cpp func: "evaluateExpression()" line: 432 Msg: failed to eval rule: invalid command name "http://testa.comp.com"
Feb 13 07:34:55 a-f5 err apd[9038]: 01490000:3: AccessPolicyProcessor/AccessPolicyProcessor.cpp func: "evaluateExpression()" line: 432 Msg: failed to eval rule: invalid command name "http://testb.comp.com/"
1 Reply
- evaluateExpression() error indicates that APD failed to run the rule and evaluate it to True or False. This can happen in at least Full Resource Assign or any item's Branch Rules area in the Access Policy.
It expects that you will give it some TCL command. In your case, you are giving it "1.2.3.4" which isn't really a TCL command. Look at the predefined items (in Simple mode) for examples of how to do this evaluation if you want to do some custom expressions. If you select something in Simple mode, you can then look at the Advanced mode tab to see what the rule details look like and modify it as you like. Note that not all of the TCL commands are available here, but most are.
