Forum Discussion
Can i use shared objects as I do data groups, in iRules?
I need to write a few iRules for policy NATing and using Shared Objects, would make the task (and iRules) cleaner and less complex.
For instance:
when CLIENT_ACCEPTED {
if {[matchclass[IP::remote_addr]] equals "international-sites_netgrp"} {
pool "infoblox-report"
# log local0
}
}
Where international-sites_netgrp is a shared object address list that contains 2 other address lists which are /16 networks.
Dave
I don't believe it is possible to reference Shared Objects within an iRule; you can only reference internal or external data groups. I agree, it would be useful to have it as a feature though.
You should not be Using matchclass (this keyword is deprecated/obsolete) instead use class match:
-
- The matchclass command is not valid in this context, it was used before v10.
- The correct command to use is class match, which is specifically designed for matching entries in data groups or shared objects.
The correct command to use is class match, which is specifically designed for matching entries in data groups or shared objects.- when CLIENT_ACCEPTED {
if { [class match [IP::remote_addr] equals international-sites_netgrp] } {
pool infoblox-report
# log local0
}
} - if { [class match [IP::remote_addr] equals international-sites_netgrp] }:
- class match: This command checks if the client's IP address ([IP::remote_addr]) matches any entry in the specified data group or shared object.
- [IP::remote_addr]: This command retrieves the IP address of the client.
- equals international-sites_netgrp: This specifies the name of the shared object (address list) that contains the IP addresses or subnets to match against. In this case, international-sites_netgrp is a shared address list that includes other address lists or IP ranges.
Incorrect Syntax:- Using incorrect syntax or commands that are not supported by iRules will result in errors and the iRule will not function as intended.
For example, using class match [IP::remote_addr] without proper spacing or brackets will cause syntax errors.
Not Using Shared Objects:- If you do not use shared objects or data groups, you would need to hard-code the IP addresses or subnets directly in the iRule, making it less flexible and harder to maintain. Shared objects allow you to manage and update the lists separately from the iRule, simplifying maintenance and updates.
- Using incorrect syntax or commands that are not supported by iRules will result in errors and the iRule will not function as intended.
-
I don't believe it is possible to reference Shared Objects within an iRule; you can only reference internal or external data groups. I agree, it would be useful to have it as a feature though.
The weird part is that the irule (as I have written above) gets saved without any errors. I haven't applied the rule to a VIP - because I wanted to wait for confirmation that it should work.
Dave
I know that certain objects that you reference (e.g. a pool name) get validated when you try to save the iRule to see if they actually exist (if it doesn't exist, you will get an error), but I don't think there is any validation for objects that are referencing using the match class / class match command.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com