Forum Discussion
Change fastL4 profile in iRule
Hi,
Is it possible to change which fastL4 profile you are using from within an iRule?
My situation is that I need to have an indefinite idle timeout on connections from certain ip addresses, ideally I would modify IP::idle_timeout in the iRule; but there is no valid IP::idle_timeout that will set indefinite. To check if it was possible to set indefinite from within an iRule I changed the fastL4 profile to have indefinite idle timeout then logged the value of IP::idle_timeout
when CLIENT_ACCEPTED {
if { [IP::addr [IP::client_addr] equals 10.1.1.1] } {
log local0. "original timeout: [IP::idle_timeout]"
}
}
This resulted in log lines
CLIENT_ACCEPTED: original timeout: -1
I tried to set this value from within my iRule
<pre class="prettyprint lang-tcl">`when CLIENT_ACCEPTED {
if { [IP::addr [IP::client_addr] equals 10.1.1.1] } {
log local0. "original timeout: [IP::idle_timeout]"
IP::idle_timeout -1
log local0. "modified timeout: [IP::idle_timeout]"
}
}
However this produced the following output
- invalid timeout value (line 1) invoked from within "IP::idle_timeout -1"
So my next thought was to create multiple fastL4 profiles and one of them can have indefinite timeouts, then I can switch to this profile from within my iRule for the connections that I need an indefinite timeout on. Problem being I cannot see a way to change profile from within an iRule.
Any ideas?
5 Replies
- uni_87886
Cirrostratus
You can set it to 2147483647 instead. It is not indefinite, but 68 years should be enough. Hopefully the bug will be fixed before your first timeout.
- Adam_1553
Nimbostratus
Thanks, I'll go with this for now, it's close enough to indefinite that I won't have to worry about it.
- uni
Altocumulus
You can set it to 2147483647 instead. It is not indefinite, but 68 years should be enough. Hopefully the bug will be fixed before your first timeout.
- Adam_1553
Nimbostratus
Thanks, I'll go with this for now, it's close enough to indefinite that I won't have to worry about it.
- JRahm
Admin
no, you can't change the L4 profiles in stream. What you could do is set up three vips, one front-end vip and two back-end vips, setting the front-end and one back-end to indefinite, then the other back-end to a limited timeout, and use the front-end vip to switch the traffic. Still has the risk of port exhaustion if you get flood attacked on the front-end, but you could add policing logic into your front-end iRule for the connections not specifically allowed for indefinite timeouts.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
