Calling an ICALL from an IRULE

Question

HI,&nbsp;
I am trying to call an Icall from an Irule but couldn't do it. I try this =&nbsp;
sys icall istats-trigger delete_entry_trigger_istats {
    event-name deletecon
    istats-key "wa policy string prueba_xxa"
}&nbsp;
then in the irule I put this &nbsp;
when  CLIENT_ACCEPTED {
ISTATS::set "wa policy string prueba_xxa" 1
}&nbsp;
But the Icall won't triggered &nbsp;
ICALL SCRIPT&nbsp;
sys icall script delete_entry_conecction_script {
    app-service none
    definition {
        tmsh::delete sys connection cs-client-addr 192.168.1.97
        exec istats remove "wa policy string prueba_xxa"
    }
    description none
    events none
}&nbsp;
ICALL HANDLER&nbsp;
sys icall handler triggered delete_entry_conecction_handler {
    script delete_entry_conecction_script
    subscriptions {
        messages {
            event-name deletecon
        }
    }
}&nbsp;
ICALL TRIGGER&nbsp;
sys icall istats-trigger delete_entry_trigger_istats {
    event-name deletecon
    istats-key "wa policy string prueba_xxa"
}&nbsp;
For now the goal is to achieve the tmsh command delete sys connection cs-client-addr 192.168.1.97 via Icall&nbsp;
Thanks for your support.&nbsp;

jaikumar_f5 · Answer

Icall script/handler everything looks good to me, can you confirm if it did not delete the connection table ?&nbsp;

jaikumar_f5 · Answer

Happened to this using custom trap (/config/user_alert.conf), this does work though, 
alert testing "JAI" {
    exec command="tmsh generate sys icall event deletecon"
}

Checking the connection table cleared the entries.

stanislas_piro2 · Answer

irules are executed in data plane, icall are executed in control plane.&nbsp;
you can't execute icall from irule. the only solution is to execute a sideband connection to icontrol API from irule.&nbsp;

sergio000_19532 · Answer

Hi I make a change recently to try to achieve the final goal, which is to when a new connection comes the big IP closed the already established.
when LB_QUEUED {
ISTATS::set "wa policy string prueba_xxa" 1
}
So I put a queue un depth 1 an at pool member level a connection limit of 1 an also put the CMP Mode of the virtual server in single-cpu mode.
When I test this scenario I open two telnet session and just the first connection appears in show sys connection ss-server-addr then I force the Icall with generate sys icall event deletecon and the queue connection is established with the pool member. So I think that the Icall is working but I couldn't link the Irule with the Icall, so in the even of an LB_QUEUED drops the stablished connection a permit the queded.
Thx all for your answers.

sergio000_19532 · Answer

Hi please, how can I call this :&nbsp;
alert testing "JAI" {
    exec command="tmsh generate sys icall event deletecon"
}&nbsp;
through the iRULE ?&nbsp;

Forum Discussion

Calling an ICALL from an IRULE

Recent Discussions

ports are showing open on online scanning tool

Upgrade F5 BIGIP

DNS HM Probe issue

Is XFF a must for ASM WAF DoS

Switch ssl profile based on weak cipher detection via IRULE

Related Content

vip call another vip with internal ip

use curl to call restapi

iRULE regsub error

Execute iCall from iRule

Icall routing path

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS