"event disable all" does not stop further ltm rule processing

Hello,

"event disable all" stop the current iRule processing and all subsequent iRules from processing as well. You can use just "return", it Causes immediate exit from the currently executing event... So I advise you to use "return" in your case instead "event disable all". Then disable only other subsequent event if needed...

You have to let process this irule

if { not [class match [IP::client_addr] equals my-net-CLASS ] } {
log local0. "===== D R O P P E D : ====================="
log local0.debug "IP::client_addr: [IP::client_addr]"
HTTP::respond 403 content {403 Forbidden}
event disable all
    }

For this modify "event disable all" by "return". I think if you use "event disable all" in this case you will have multiple redirect: First

HTTP::respond 403 content {403 Forbidden}

Let me now if i can help you. regards