For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Anthony_Epron's avatar
Anthony_Epron
Icon for Nimbostratus rankNimbostratus
Dec 08, 2016

How use Datagroup in iRule ?

Hello Guys,

I need to write an iRule for extract the radius attribute 81 and check if this attribute is present on my datagroup.

For the moment i write this iRule :

when CLIENT_DATA {

log "Irule OK"

set attr81 [RADIUS::avp 81]

log "The vlan is $attr81"

if { [class match [RADIUS::avp 81] contains vlancheck] } {

log "Vlan OK"

} else {

log "Vlan not OK"

}

}

And I create a datagroup with the String vlan=IDVlan.

But my iRule don't match the string on the Datagroup.

Could you please help me ? 🙂

Thanks.

iRules
security

2 Replies

  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Dec 08, 2016

    Hi

    could you please post the output of 

    log "The vlan is $attr81"
    and the exact format of the string that should match?

    Cheers, Kai

  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Dec 08, 2016

    Hi Anthony,

    The first column of the data-group is the "search string" and the seconds column is the "return-value" of the data-group entry. The 

    equals
    , 
    contains
    , 
    starts_with
    or 
    ends_with
    operators of the 
    [class match]
    command is always comparing your 
    $input
    with the "search strings" of the given datagroup and then may or may not return the return-data or simply boolean 0|1 depending on the used 
    [class]
    command syntax...

    You can give it another try using the slightly polished iRule below...

    when CLIENT_DATA {
    log "Irule OK - The vlan is [RADIUS::avp 81]"
    if { [class match [RADIUS::avp 81] equals vlancheck] } {
        log "Vlan OK"
    } else {
        log "Vlan not OK"
    }
}

    ... in combination with a modified data-group...

    ltm data-group internal vlancheck {
    records {
        202 { }
        203 { }
    }
    type string
}

    Cheers, Kai