How to config PBR

[root@iris:Active] config  b virtual test list all
virtual test {
   enable
   limit 0
   rate class none
   mirror disable
   translate address disable
   translate service disable
   srcport preserve
   pool
   snat none
   cmp enable
   cmp processor none
   lasthop pool none
   snatpool none
   pool gw1
   fallback persist none
   destination any:any
   mask 0.0.0.0
   ip protocol tcp
   partition Common
   rules none
   httpclass none
   persist none
   auth none
   clone pools none
   profiles tcp {
         all
      }
   traffic classes none
   vlans none disable
}
[root@iris:Active] config  b pool gw1 list
pool gw1 {
   members 172.28.17.254:any {}
}
[root@iris:Active] config  b route list
No Routing Table Entries were found.

[root@iris:Active] config  tcpdump -nni 0.0 -e port 80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on 0.0, link-type EN10MB (Ethernet), capture size 108 bytes
12:13:18.896745 00:01:d7:20:81:85 > 00:01:d7:2f:0d:c3, ethertype 802.1Q (0x8100), length 78: vlan 4094, p 0, ethertype IPv4, 10.10.72.60.59619 > 8.8.8.8.80: S 865485221:865485221(0) win 5840 
12:13:18.896802 00:01:d7:2f:0d:c3 > 00:01:d7:20:81:85, ethertype 802.1Q (0x8100), length 82: vlan 4094, p 0, ethertype IPv4, 8.8.8.8.80 > 10.10.72.60.59619: S 1705596133:1705596133(0) ack 865485222 win 4380 
12:13:18.897850 00:01:d7:20:81:85 > 00:01:d7:2f:0d:c3, ethertype 802.1Q (0x8100), length 70: vlan 4094, p 0, ethertype IPv4, 10.10.72.60.59619 > 8.8.8.8.80: . ack 1 win 46 
12:13:18.897925 00:01:d7:2f:0d:c4 > 00:01:e8:d5:d4:47, ethertype 802.1Q (0x8100), length 82: vlan 4093, p 0, ethertype IPv4, 10.10.72.60.59619 > 8.8.8.8.80: S 3006714883:3006714883(0) win 4380 

5 packets captured
5 packets received by filter
0 packets dropped by kernel

[root@iris:Active] config  b arp 172.28.17.254
ARP 172.28.17.254 - 00:01:E8:D5:D4:47   VLAN external   expire 269s   resolved

Hi Experts

How will I modify the below PBR (i-Rule) to include port based forwarding? For example, I need to route traffic based on port 80/443 towards specific virtual server, for rest of the traffic, it should get routed, with F5 acting as a L3 hop.

         when CLIENT_ACCEPTED {
if { [IP::addr [IP::local_addr] equals 10.0.0.1/24 ]}{ 
     pool pool_hop_1
} elseif { [IP::addr [IP::client_addr] equals 192.168.1.0/24]}{ 
     pool pool_hop_2
} else { 
     pool pool_hop_3
}

}

Hi,

Try this (haven't tested in a lab). Obviously pool named pool_hop_1 must exist.

when CLIENT_ACCEPTED {
    log local0. "PBR iRule starting"
    if { [TCP::local_port clientside] equals 80 } {
        if { [active_members pool_hop_1] < 1 } {
            log local0. "No active pool members so will SNAT"
            snat automap
        } else { 
            pool pool_hop_1
            log local0. "PBR on port 80 successful"
        }
    }
}

how do I combine both conditions of IP address & port?

e.g.

  if { [IP::addr [IP::local_addr] equals 10.0.0.1/24] and 
    ( [TCP::local_port] == 80 or [TCP::local_port] == 443 ) } {

[active_members pool_hop_1] < 1

active_members command is used to make sure pool_hop_1 pool is up before sending traffic to.

active_members

how do I combine both conditions of IP address & port?

e.g.

  if { [IP::addr [IP::local_addr] equals 10.0.0.1/24] and 
    ( [TCP::local_port] == 80 or [TCP::local_port] == 443 ) } {

[active_members pool_hop_1] < 1

active_members command is used to make sure pool_hop_1 pool is up before sending traffic to.

active_members

Can I use a named pool "my_subnets" instead of only IP segment 10.0.0.0/24? "my_subnets" would have, say 20 subnets?

if there are number of ip/subnet, you can use "class match" command instead of IP::addr. ip/subnet is defined in ip type data group.

class

Can I use a named pool "my_subnets" instead of only IP segment 10.0.0.0/24? "my_subnets" would have, say 20 subnets?

if there are number of ip/subnet, you can use "class match" command instead of IP::addr. ip/subnet is defined in ip type data group.

class