For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

mariogolf_57851's avatar
mariogolf_57851
Icon for Nimbostratus rankNimbostratus
Oct 08, 2009

iControl and bigipie conn server vip-ip:port delete

Well I minorly tweeked two awesome PERL scripts togglePoolMembers and toggleNodes to:

 

down and session disable pool members and then down disable the node.

 

These PERL samples were instrumental in downing POOL MEMBER : PORT's within members when say something goes wrong

 

on a particular server e.g. LDAPS and you want to disable it's instance from the BipIP. Better spoken when you

 

desire new connections NOT to go to this server which in is jeopardy.

 

Now...

 

The bigpipe conn server vip-ip:port delete

 

Is essential in breaking all current connections from the VIP housing the server in jeopardy.

 

Can iContol perform this service? Or is there another way to do this service as it is generally an essential

 

element of this equation?

 

Thanks
dev
devops
iControl

6 Replies

  • Joe_Pruitt's avatar
    Joe_Pruitt
    Oct 08, 2009
    Unfortunately access to the connection table was removed in iControl due to performance issues with accessing that large of a data set within a HTTP SOAP request. So, at this point, there is not an equivalent in the iControl API to remove individual entries in the connection table.

     

     

    -Joe
  • mariogolf_57851's avatar
    mariogolf_57851
    Icon for Nimbostratus rankNimbostratus
    Oct 08, 2009

     

    Well then is there a way to execute a raw bigpipe command using iControl. I'll assume not.

     

    Thinking outside the bun, maybe an iRule could do it? Create it then delete it?

     

    I am looking @ automation. Soup to Nuts so to speak. Without this functionality it is half baked for me.

     

    When a pool member is "session disabled" and node is same, persistent connections remain indefinitely.

     

    Do you have any juju in your bag for breaking these connections to said VIP?

     

     

     

     

    Thanks much
  • mariogolf_57851's avatar
    mariogolf_57851
    Icon for Nimbostratus rankNimbostratus
    Oct 11, 2009
    What if you use iControl virtual support and delete and re-create the virtual? Will that down the connections?

     

     

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Oct 29, 2009
    Hi Joe,

     

     

    Is there an existing CR requesting this functionality be added back in a usable way? It seems like there are a few people interested in this:

     

     

    System::Connections seems to be gone from the SDK

     

    http://devcentral.f5.com/Default.aspx?tabid=53&view=topic&postid=86013&forumid=1&tpage=186023

     

     

    Rejecting a connection based on address and time of day?

     

    http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=85953&view=topic

     

     

    Thanks,

     

    Aaron
  • mariogolf_57851's avatar
    mariogolf_57851
    Icon for Nimbostratus rankNimbostratus
    Oct 29, 2009
    A rumor is pycontrol has support for this. How to run pycontrol under Linux as Windows is NOT an option.