data group not matching

Which LTM version are you running? For 9.4.4+ you should remove the $:: prefix from the datagroup name references in the iRule. If you're on v10, you could also change matchclass to 'class match' to improve the efficiency of the iRule:

 

 

http://devcentral.f5.com/wiki/default.aspx/iRules/class

 

 

Also, if you're using IIS, you should set the URI to lowercase in the switch statement. You could also check HTTP::path instead of HTTP::uri. This would catch someone using a URI like /login.aspx? or /login.aspx?ignore=this to bypass your logic.

 

 

switch -glob [string tolower [HTTP::path]] {

 

 

Aaron