Forum Discussion
Neil_Rosedahl
Nimbostratus
NimbostratusDuplicate netflow traffic via iRule
Netflow traffic is coming into a VIP and pool and then the traffic is duplicated via an iRule to aonther set of servers. The traffic being duplicated is not complete. The iRule is based on IP addresses defined in a data group and sent to a specific IP. This is the iRule being used:
when RULE_INIT {
set static::timeout "30"
}
when CLIENT_DATA {
if { [class match [IP::client_addr] equals SOC_Core_1] } {
set conn [connect -protocol UDP -myaddr [IP::client_addr] -timeout $static::timeout -idle 30 -status conn_status 10.65.46.98:2055]
set send_info [send -timeout $static::timeout -status send_status $conn [UDP::payload]]
set sessionCheckResponse [recv -timeout $static::timeout -status recv_status $conn]
}
elseif { [class match [IP::client_addr] equals SOC_Core_2] } {
set conn [connect -protocol UDP -myaddr [IP::client_addr] -timeout $static::timeout -idle 30 -status conn_status 10.65.46.99:2055]
set send_info [send -timeout $static::timeout -status send_status $conn [UDP::payload]]
set sessionCheckResponse [recv -timeout $static::timeout -status recv_status $conn]
}
elseif { [class match [IP::client_addr] equals All_Hubs] } {
set conn [connect -protocol UDP -myaddr [IP::client_addr] -timeout $static::timeout -idle 30 -status conn_status 10.65.46.100:2055]
set send_info [send -timeout $static::timeout -status send_status $conn [UDP::payload]]
set sessionCheckResponse [recv -timeout $static::timeout -status recv_status $conn]
}
else {
set conn [connect -protocol UDP -myaddr [IP::client_addr] -timeout $static::timeout -idle 30 -status conn_status 10.65.46.101:2055]
set send_info [send -timeout $static::timeout -status send_status $conn [UDP::payload]]
set sessionCheckResponse [recv -timeout $static::timeout -status recv_status $conn]
}
}
Also traffic that comes in to the VIP and pool nodes include the NetFlow/IPFIX, but when it is duplicated in the iRule, the Netflow/IPFIX is incomplete.
boneyardMVP
would a clone pool not achieve the same and be easier?
https://support.f5.com/csp/article/K13392
Neil_RosedahlThanks for the response. I have to duplicate traffic to each IP in the iRule based on source IP. Data groups have been created to do this. I wish I could just duplicate all the traffic to another pool. In this case the iRule is not getting the IPFIX flows for some reason. the virtual server pool for another set of servers gets the complete packets. Just not sure what to change in the iRule. I was thinking it would just duplicate all the packets coming in and sending to a set of IPs based on various sources.