Forum Discussion

Dave_P_130251's avatar
Dave_P_130251
Icon for Nimbostratus rankNimbostratus
Jul 09, 2015

Disable / enable an irule via an irule

We have existing F5 LTM / ASM sandwich configuration in place and I ran into an issue with a few apps. Basically in our ltm/asm sandwich you have the initial vip that terminates ssl etc that has a pool that sends traffic to the asms. The asms would then inspect and send the data back to the same originating ltm (separate vip with serverssl enabled) then down to the web servers. That initial vip will have server ssl enabled as well so I use an irule to disable that server ssl:

 

when CLIENT_ACCEPTED {

 

set asm_enabled "true" if { ([active_members asm pool] >= 1) and ($asm_enabled eq "true") } { SSL::disable serverside pool asm pool } else { pool server pool } }

 

So if the asm pool would fail the ltm would just send to the server pool versus the asm. Since the vip has the serverssl enabled it would be sending encrypted as configured.

 

Now what I have found is some initial vips have other irules enabled like for snat and other custom settings. The solution in a ltm/asm sandwich is just to move the irules to the second ltm vip that sends the traffic to the servers. However if the asms would fail and the initial vip would then just send to the web servers the irules that were moved to the second vip would not exist.

 

So to put it into a picture: asm pool up client --> f5 ltm vip1 (only irule is the asm pool check) --> asm pool --> f5 ltm vip2 (snat irule in place) --> web server pool

 

asm pool down client --> f5 ltm vip1 (asm pool check only, no snat irule since it was moved to vip2) --> web server pool

 

So is there a way to add a condition where if the asm pool failed then irule::enable irule snat, using my example drawing above?

 

application delivery
ASM Advanced WAF
devops
iRules
LTM
security

2 Replies

  • samstep's avatar
    samstep
    Icon for Cirrocumulus rankCirrocumulus
    Jul 10, 2015

    it is quite difficult to understand what you are trying to achieve without understanding what irules are attached to what vips and their functionality.

     

    I think the following may help:

     

    1. iRules have a "return" command - which allows to exit the current event and not proceed any further -you can use it after some condition checking: https://devcentral.f5.com/wiki/iRules.return.ashx

       

    2. "event" command allows you to enable/disable processing of specific event further down the stack: https://devcentral.f5.com/wiki/iRules.event.ashx

       

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Jul 10, 2015

    there is no way to enable an irule in another irule, but you can change static variable in one irule and evaluate the value of this variable in another irule...

     

    but the best way in your irule is to enable SNAT if pool member is unavailable.