Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

ssam_138429's avatar
ssam_138429
Icon for Nimbostratus rankNimbostratus
Jan 03, 2018

Irule Help

Dears,   Need some help on the F5 configuration. The requirements are: 1.Do not apply URI redirect if the request is coming from a particular subnet. 2.Apply URI redirect otherwise.   Tried the...
irules
LTM
security
nitass_89166's avatar
nitass_89166
Icon for Noctilucent rankNoctilucent
Jan 03, 2018

i think you had better also check uri.

e.g.

when HTTP_REQUEST {
  if { ![IP::addr [IP::client_addr] equals 10.1.2.0/24] and [HTTP::uri] eq "/" } {
    HTTP::redirect "http://[HTTP::host]/cams"
  }
}
  • ssam_138429's avatar
    ssam_138429
    Icon for Nimbostratus rankNimbostratus
    Jan 03, 2018

    No luck. I have tried enabling logging and found the irule is not detecting the ip address.

     

    when HTTP_REQUEST {log local0. "before ip" if { ![IP::addr [IP::client_addr] equals 10.1.2.0/24] and [HTTP::uri] eq "/" } { log local0. "after ip" HTTP::redirect "http://[HTTP::host]/cams" } }

     

  • ssam_138429's avatar
    ssam_138429
    Icon for Nimbostratus rankNimbostratus
    Jan 03, 2018

    I am getting only the "before ip" in the logs. Seems like the if condition is not matching.

     

  • ssam_138429's avatar
    ssam_138429
    Icon for Nimbostratus rankNimbostratus
    Jan 06, 2018

    Any luck or suggestions ?

     

  • nitass_89166's avatar
    nitass_89166
    Icon for Noctilucent rankNoctilucent
    Jan 06, 2018

    have you added logging Lee (MrPlastic) suggested? can you post the log?

     

  • ssam_138429's avatar
    ssam_138429
    Icon for Nimbostratus rankNimbostratus
    Jan 10, 2018

    yes I have tried that but no luck

     

  • Morten_Marstran's avatar
    Morten_Marstran
    Icon for Nimbostratus rankNimbostratus
    Jan 10, 2018

    I tested this in my lab now, and it works fine. My BIG-IP is running version 12.1.2 (Build 1.0.271).

     

    Can you start a tcpdump and verify that the source IP (client side) actually is what you expect it to be?

     

    Regards, Morten