Forum Discussion

sstafford's avatar
sstafford
Icon for Nimbostratus rankNimbostratus
Dec 04, 2014

HSL iRule broken after the move from 11.4 to 11.6

Here's the basic iRule. We're using to record client ip addresses for ldap requests in a snatted environment. Working without issue in 11.4. Failing entirely in 11.6. Any help is immensely appreciated.

 

when CLIENT_ACCEPTED { set hsl [HSL::open -proto UDP -pool /Common/syslog-pool] }

 

when SERVER_CONNECTED { set FrontEnd "[IP::client_addr]:[TCP::client_port] <-> [clientside {IP::local_addr}]:[clientside {TCP::local_port}]" set BackEnd "[IP::local_addr]:[TCP::local_port] <-> [serverside {IP::remote_addr}]:[TCP::server_port]" Log connection details as local7.info; see RFC 3164 Section 4.1.1 - "PRI Part" for more info HSL::send $hsl "<190> LDAP HSL: $FrontEnd | $BackEnd" test by logging locally log local0. "$FrontEnd $BackEnd" }

 

Notes: 1. iRule will correctly write to the local logs if I uncomment that functionality. Changing from an HSL pool to an HSL publisher makes no difference in lack of functionality.

 

  1. The vip using the iRule exists in a different partition than /Common, but replicating the pool, iRule and/or the publisher in the other partition makes no difference in lack of functionality.

     

  2. $hsl resolves to "MDS:/Common/syslog-pool:UDP"

     

application delivery
devops
hsl
iRules
LTM

5 Replies

Sort By
  • sstafford's avatar
    sstafford
    Icon for Nimbostratus rankNimbostratus
    Dec 04, 2014

    I think we got it. It appears to be somewhat related to the issues in this old SOL; https://support.f5.com/kb/en-us/solutions/public/11000/600/sol11659

     

    The firewall logs are recording a large number of denies on traffic between the LTMs and the syslog servers that look like this;

     

    Dec 4 14:21:00 152.19.253.108 RT_FLOW: RT_FLOW_SESSION_DENY: session denied 127.1.1.2/5966->172.27.47.21/514 junos-syslog 17(0) DC-UNIVERSAL-DENY(global) F5-Datacenter-DMZ ITS-OS-DMZ-prod UNKNOWN UNKNOWN N/A(N/A) reth0.1641

     

    Nothing like this appears in those logs prior to the upgrade to 11.6.

     

    So, for whatever reason, the ip address the F5 is using to communicate via HSL changed from the floating ip to 127.1.1.2. Any ideas on how to address that?

     

  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Dec 04, 2014

    Hi,

     

    Can you open a support case and reference BZ454636? There should be a workaround and/or fix available via F5 Support.

     

    Thanks, Aaron

     

    • sstafford's avatar
      sstafford
      Icon for Nimbostratus rankNimbostratus
      May 29, 2015
      Yes. It started functioning again after Hotfix 4 was applied.
Related Content