Forum Discussion

Ustrum's avatar
Ustrum
Icon for Cirrus rankCirrus
Jul 19, 2022

Enabling ASM profile from iRule fails

Hi everyone! I´m currently loadbalancing several hosts through the same VIP and I´d like to enable a different ASM profile for each service. To do so I´m trying to use an iRule like this:   when ...
application delivery
security
  • CA_Valli's avatar
    CA_Valli
    Jul 20, 2022

    Thanks for replying, what is your current BIGIP version? 

    Do you happen to see this message in /var/log/ts/bd.log as well?

     

    did not receive account configuration after 600 seconds

     

    If you see this you the cause might be BUG ID850673 

     

    Also, is the policy name shown as expected in bigip.conf file? Does this only happen on test policy or is it the same for all names? Since you said this is a test policy, have you tried deleting it and creating a new one? 

gersbah's avatar
gersbah
Icon for Cirrostratus rankCirrostratus
Jul 19, 2022

Any reason why you are doing this in an iRule and not the Local Traffic Policy?

I know iRules are often still much more flexible, but specifically for this purpose of switching pool/policy based on hostname, I find the LTM policies very straight forward.

Not sure if this would fix your problem, but maybe worth a try.

  • Ustrum's avatar
    Ustrum
    Icon for Cirrus rankCirrus
    Jul 19, 2022

    Well that would probably work just as fine, but it would mean we´d need to mantain the logic in the policy, whereas this way we just need to add a hostname to the data class and create the pool and asm policy for everything to work. Also the pool part is already working and fully automated. Moving to LTM policies would imply refactoring all our automatisms.