For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Bill_Brazill's avatar
Bill_Brazill
Icon for Employee rankEmployee
Aug 05, 2014

appended url redirect to new pool

I am trying to help our web developers test individual servers in the pool, but still go through the LTM. My idea is to have them append the original url. First I will create a new pool with the same servers, then by disabling/enabling pool members in the existing and new pool we can isolate individual servers for testing. Next I need the irule, which I am pretty new to, so that is where I need help. I want to use an appeneded url for example website.com and add website.com/testserver. Then use the irule to redirect to a new pool with the test server, but then I believe I would need to strip the /testserver back out of the request. My biggest concern is not to disrupt the existing web traffic as this will be put in production. Does this seem to be the best approach, and if so I would really appreciate some help constructing my irule. Here is what I have so far. Figured I could comment out the logs after initial troubleshooting. Not sure where to start with stripping back to the original url. Also feel free to completely ignore what I have in my irule so far.

 

when HTTP_REQUEST { Test server redirect switch -glob [string tolower [HTTP::path]] { "^/testserver" { log local0. "Client hit [HTTP::host][HTTP::path] and was directed to test pool" pool website.com_server_test } default { log local0. "Client hit [HTTP::host][HTTP::path] without being filtered" pool website.com }

 

}

 

Thanks in advance, Bill

 

application delivery
design
devops
iRules
LTM

2 Replies

  • Kevin_Davies_40's avatar
    Kevin_Davies_40
    Icon for Nacreous rankNacreous
    Aug 06, 2014

    You might find it easier to do this... create a new pool for each server called test1, test2 or test3 with just the single server in it.

    when HTTP_REQUEST {
  if {[HTTP::uri] contains testserver} { 
    pool test[URI::query [HTTP::uri] testserver]
  }
}

    Then you can specify individual server with http://my.site.com/?testserver=1

    Alternatively you can do it without extra pools if you know the IP addresses.

    Say your servers are

    10.10.10.55 port 8080

    10.10.10.56 port 8080

    10.10.10.57 port 8080 
    when HTTP_REQUEST {
  if {[HTTP::uri] contains testserver} { 
    pool poolname member 10.10.10.[URI::query [HTTP::uri] testserver]
  }
}

    Then you can specify individual server with http://my.site.com/?testserver=55

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Aug 06, 2014

    you may also have to make sure all embedded object in page is using relative path (not absolute path).

    e.g.

     config

root@(B6900-R69-S40)(cfg-sync Standalone)(Active)(/Common)(tmos) list ltm virtual bar
ltm virtual bar {
    destination 100.100.100.41:80
    ip-protocol tcp
    mask 255.255.255.255
    pool foo
    profiles {
        http { }
        tcp { }
    }
    rules {
        qux
    }
    source 0.0.0.0/0
    source-address-translation {
        type automap
    }
    vs-index 3
}
root@(B6900-R69-S40)(cfg-sync Standalone)(Active)(/Common)(tmos) list ltm pool foo
ltm pool foo {
    members {
        200.200.200.101:80 {
            address 200.200.200.101
        }
    }
}
root@(B6900-R69-S40)(cfg-sync Standalone)(Active)(/Common)(tmos) list ltm pool testserver
ltm pool testserver {
    members {
        200.200.200.111:80 {
            address 200.200.200.111
        }
    }
}
root@(B6900-R69-S40)(cfg-sync Standalone)(Active)(/Common)(tmos) list ltm rule qux
ltm rule qux {
    when HTTP_REQUEST {
  if { [string tolower [HTTP::path]] starts_with "/testserver/" } {
    HTTP::uri [string map {/testserver/ /} [HTTP::uri]]
    pool testserver
  }
}
}


 trace

[root@B6900-R69-S40:Active:Standalone] config  ssldump -Aed -nni 0.0 port 80
New TCP connection 1: 100.100.100.3(33050) <-> 100.100.100.41(80)
1407298766.2703 (0.0553)  C>S
---------------------------------------------------------------
HEAD /testserver/something?abc=1234 HTTP/1.1
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Host: 100.100.100.41
Accept: */*

---------------------------------------------------------------

New TCP connection 2: 200.200.200.40(33050) <-> 200.200.200.111(80)
1407298766.5858 (0.2505)  C>S
---------------------------------------------------------------
HEAD /something?abc=1234 HTTP/1.1
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Host: 100.100.100.41
Accept: */*

---------------------------------------------------------------