For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Hank_Stallings's avatar
Hank_Stallings
Icon for Nimbostratus rankNimbostratus
Aug 21, 2013

Does HTTP Class Profile take precedence over an iRule?

I have an iRule that allows me to target a specific pool member. It works great on three VIPs...two are QA and one production. It creates the cookie I correctly, but not sure it is referencing the Data Group List to assign the node to go to.

Our company has a US firm and a Global firm, and we two different F5 teams. The working VIPs are in the US. When I had my iRule implemented in the Global firm, it doesn't work. One big difference is that the Global firm uses an HTTP Class Profile configured for acceleration. My question is does the HTTP Class Profile supersede the iRule?

when RULE_INIT {
set static::cookie_name "my_node_forced"
}
when HTTP_REQUEST {
 Get node id from URL ending in ?node=10, ?node=11, etc.
set node_forced [findstr [HTTP::query] "node=" 5]

 Or from previous cookie
set has_cookie [HTTP::cookie exists $static::cookie_name]

 If node_forced (from query) isn't there but cookie exists - set node_forced = cookie value
if { $node_forced eq "" and $has_cookie } {
set node_forced [HTTP::cookie value $static::cookie_name]
}

 If node_forced (from query) is there but cookie is not - set cookie flag
if { $node_forced ne "" and !$has_cookie } {
set do_cookie 1
} 

 Map node id to IP and port found in a class
if { $node_forced ne "" } {
set node_data [class match -value $node_forced equals my_forced_nodes]
if { $node_data ne "" } {
set node_ip [getfield $node_data " " 1]
set node_port [getfield $node_data " " 2]
pool sp2010.prod.ukdnet.wfe member $node_ip $node_port
} 
} 
}
when HTTP_RESPONSE {
if { [info exists do_cookie] } {
unset do_cookie
 Add a cookie to continue forcing node assignment
HTTP::cookie insert name $static::cookie_name value $node_forced path "/"
} 
}

1 Reply

  • the iRule will take precedence. You can verify by setting up two simple pools with a single node (can be the same) and then set the http class (or policy in 11.4, which I tested) to send traffic matching HTTP::uri /test to class-pool and then an irule to match same uri of /test to irule-pool. Hitting the vip/test resulted in the irule pool getting the traffic.

     

    All that said, you should settle on one approach to avoid confusion for those who come after you (and the other team)