For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Adi82_183873's avatar
Adi82_183873
Icon for Nimbostratus rankNimbostratus
Jan 23, 2015

iRule and data group not matching properly

Hi all, We have the following devices: 2 BIG-IPs version is version 11.4.1. HA enabled. Network topology is : Akamai --- BIG-IP --- WAF --- Servers HTTP The issue is : 1) We have several...
application delivery
devops
iRules
Arie's avatar
Arie
Icon for Altostratus rankAltostratus
Jan 23, 2015

@LyonsG is right - you want to use "type ip" and preferably netmasks.

A couple of questions:

  1. Where does the value for "True-Client-IP" come from?
  2. Is there a specific reason you're inserting XFF via an iRule instead of in the HTTP-Profile?
  3. Is there a specific reason you're using a header value to get to the client IP address (vs. using 
    IP::client_addr
    )?
  4. Wouldn't it be better to return a 503 (Service Unavailable) instead of a 302 (Temporary Redirect) followed by (presumably) a 200 (OK)?
  5. How are you activating the maintenance rule? (if you're changing the iRule that may not affect existing connections).