For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Sam_Hall's avatar
Sam_Hall
Icon for Nimbostratus rankNimbostratus
Aug 31, 2015

Event processing after using "virtual" to switch to another virtual server

Assume I have a HTTP_REQUEST irule with priority 10 that calls "virtual" to switch to another virtual server. Both virtual servers have HTTP_REQUEST events defined with priority 500. Which of these events will fire and under what circumstances? Do I have to factor in keep-alive or does the diverted virtual server simply take full control of this connection from here on in?

 

Out of curiosity, what if the diverted virtual server had a HTTP_REQUEST event with priority 5. Would that event get skipped since we're already at 10?

 

There isn't much detail about what happens in these circumstances listed here... https://devcentral.f5.com/wiki/iRules.virtual.ashx

 

application delivery
devops
iRules
LTM

1 Reply

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Aug 31, 2015

    None of the above. So a couple of points:

    1. When you attach multiple iRules to a virtual server, those iRules essentially get compiled together. If each of these iRules have the same events, then those events are also merged - hence the importance of priority ordering. For example:

      iRule 1:

      when HTTP_REQUEST priority 10 {
    log local0. "hello from pri 10"
}

      iRule 2:

      when HTTP_REQUEST priority 5 {
    log local0. "hello from pri 5"
}

      When you add these two rules to a single VIP, you'd basically get this:

      when HTTP_REQUEST {
    log local0. "hello from pri 5"

    log local0. "hello from pri 10"
}

    2. You can almost think of the virtual command like a pool or node command. While HTTP_REQUEST is triggered when the VIP has consumed all of the request HTTP headers, the virtual command works at a different level of the OSI stack that's targeting a server side resource.

    In short, if you have two HTTP_REQUEST iRules on your "external VIP" (with different priorities) and two HTTP_REQUEST iRules on your internal VIP (with different priorities). You can expect all of the external iRules to fire first (in order) and then all of the internal iRules (in order).