Forum Discussion
hung_37471
Nimbostratus
NimbostratusHow to config PBR
hi all
can you help me , how to config PBR on the BIg Ip ?
on the web GUI , i can't see anywhere to config PBR
thanks all
nitass_89166
Noctilucent
NoctilucentCan I use a named pool "my_subnets" instead of only IP segment 10.0.0.0/24? "my_subnets" would have, say 20 subnets?
if there are number of ip/subnet, you can use "class match" command instead of IP::addr. ip/subnet is defined in ip type data group.
class
https://devcentral.f5.com/wiki/irules.class.ashx
Sumanta_88744
Cirrus
CirrusHi
Need help as this is really confusing. I am unable to come up with the exact i Rule to go into the F5 LTM config. What I need is traffic from a pool of 2 subnets (say 10.1.0.0/24 and 10.2.0.0/24) would be forwarded to a Virtual Server (10.206.0.4) and rest traffic would be forwarded to the default next hop for F5 (10.206.0.8). Will pasting the below in config work? I am not aware of TCL scripts. 10.206.0.4 and 10.206.0.8 are two diff L3 segments on F5.
when CLIENT_ACCEPTED {
log local0. "PBR iRule starting"
if { if { [IP::addr [IP::local_addr] equals 10.1.0.0/24] and
( [TCP::local_port] == 80 or [TCP::local_port] == 443 or [TCP::local_port] == 8080) }
if { [active_members pool_hop_1] < 1 } {
log local0. "No active pool members so will SNAT"
snat automap
} else {
pool pool_hop_1
log local0. "PBR on port 80/8080/443 successful"
}
}
}
The VS configs are given below, first one is the Application server VS and the next one is the L3 forwarding VS (F5 is in a three legged design, one hop towards internal network, one hop towards external network and the other to real server pool):-
ltm virtual /Common/WHTTP_vs {
description "WHTTP virtual server"
destination /Common/10.206.0.4:8080
ip-protocol tcp
mask 255.255.255.255
persist {
/Common/MSP-Persistence {
default yes
}
}
pool /Common/WHTTP
profiles {
/Common/fastL4 { }
}
source 0.0.0.0/0
translate-address disabled
translate-port disabled
vlans {
/Common/radio-external
}
vlans-enabled
ltm virtual /Common/forwardToInternet_vs {
address-status no
description "Outbound traffic to ISP"
destination /Common/0.0.0.0:0
ip-forward
mask any
profiles {
/Common/IP-Gateway { }
}
source 0.0.0.0/0
translate-address disabled
translate-port disabled
vlans {
/Common/www-internal
}
vlans-enabled