Forum Discussion

touch_93816's avatar
touch_93816
Icon for Nimbostratus rankNimbostratus
May 05, 2011

Distributing the traffic base on the port

Hi All

 

 

I am facing some difficulty about generating IRule to distribute the traffic to different destination hosts but I can not make it work and really hope you could help me.

 

 

 

My scenario is

 

 

 

I have one server on Vlan98 and its IP is 192.168.98.2

 

There are some other two servers on different vlan 96. Let's say 192.168.96.2 & 192.168.96.3.

 

 

 

Now I want to make all these servers can communicate with each other. So I have created a virtual server 192.168.98.3 and sign a pool which has two nodes 96.2 and 96.3 in it to this VS.

 

 

 

What I want to achieve is ssh from 98.3 to other two servers on different Vlan with different port number. My Irule is below:

 

 

 

when CLIENT_ACCEPTED {

 

switch [TCP::server_port] {

 

"2222" { pool TempPool member 192.168.96.2 22 }

 

"3333" { pool TempPool member 192.168.96.3 22 }

 

}

 

}

 

 

 

 

But this irule does not work. So could you please give me a hand?

 

 

 

Thank you and looking forward to see your reply.

 

3 Replies

  • Try changing TCP::server_port to TCP::local_port. In the CLIENT_ACCEPTED event, no serverside connection has been established yet, so TCP::server_port isn't a valid command in this context. If you want to check the client's destination port, it's LTM's local port. See the wiki page for a bit more info:

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/tcp__local_port

     

     

    You could also use forwarding virtual servers to do this without destination address or port translation:

     

     

    BEST PRACTICE: SOL7229 - Methods of gaining administrative access to nodes through the BIG-IP system

     

    http://support.f5.com/kb/en-us/solutions/public/7000/200/sol7229.html?sr=14231306

     

     

    Aaron
  • Hi Aaron

     

     

    Thank you very much for your quick reply. I have tried the local_port but it does not work either. Now I am looking into another option. Could you please let me know is there any thing I can use to make it work if I want to use "port"?

     

     

     

    Thank you again and looking forward to see your reply.

     

     

     

     

     

  • What happens when it doesn't work? Do you get an error when trying to save the iRule? Or when you attempt a connection? Can you check /var/log/ltm for any runtime TCL errors? If you don't see any errors, can you post an anonymized copy of the 'b virtual VS_NAME list' output?

     

     

    Thanks, Aaron