iRule: persist uie "$var1:$var2"

Hi Cjunior,

Thank you for the answer. Indeed i have the same conclusions - i need two persistence records. But how to create two persistence records ? I have my data only in client request (not server response). When i have tried to create two persistence records in CLIENT_ACCEPTED or SERVER_DATA using "persist uie" or "persist add uie" always only the last one was created.

What are the limitation for creation of 2 persistence records ?

I would like to achieve:

- on client request: check if there is persistence for $var1 - if yes follow
- on client request: check if there is persistence for $var2 - if yes follow 
- on client request: create/update persistence record for $var1
- on client request: create/update persistence record for $var2

Possible ?

Thanks, Michal

Hi Michal,

when HTTP_REQUEST {
   log local0. "[IP::client_addr]:[URI::query [HTTP::uri] param1]"
   persist uie "[IP::client_addr]:[URI::query [HTTP::uri] param1]"
}

I.e. you try to persist on combined client IP and a query parameter. Now watch your persistence table (specify

mode

virtual

all-properties

watch -d 'tmsh show ltm persist persist-records mode universal virtual vs_51 all-properties'

Sys::Persistent Connections
universal - 10.131.131.51:80 - 10.131.131.64:80
-------------------------------------------------
  TMM           1
  Mode          universal
  Value         10.131.131.176:abc
  Age (sec.)    36
  Virtual Name  /Common/vs_51
  Virtual Addr  10.131.131.51:80
  Node Addr     10.131.131.64:80
  Pool Name     /Common/pool_distribution_service
  Client Addr   10.131.131.176
  Owner entry

universal - 10.131.131.51:80 - 10.131.131.63:80
-------------------------------------------------
  TMM           1
  Mode          universal
  Value         10.131.131.176:hij
  Age (sec.)    24
  Virtual Name  /Common/vs_51
  Virtual Addr  10.131.131.51:80
  Node Addr     10.131.131.63:80
  Pool Name     /Common/pool_distribution_service
  Client Addr   10.131.131.176
  Owner entry

Total records returned: 2

Whenever the value ist matched, the associated poolmember will be reselected.

curl -v http://10.131.131.51/path?param1=hij

Thanks, Stephan

Hi Stephan,

Thank you for that example. But i do not want AND ("combination of parameters") but OR logic. Real example:

- Incoming Radius Access-Request with Calling-Station-ID create persistence for Calling-Station-Id
- Incoming Radius Accounting-Request with Calling-Station-ID should be redirected to the same node
(as per persistence) but at the same time i would like to create a new persistence record based on Framed-IP-Address attribute
- Incoming HTTP traffic: take source ip and match with persistence entry for Framed-IP-Address

Radius (Authentication + Accounting) is one virtual server, HTTP is the other. How would you prepare iRules for both ?

Thanks, Michal

Hi Stephan,

Radius and HTTP are identical - same servers - just different tcp/udp ports.

I need to bind Radius Authentication with Radius Accounting using Calling-Station-id (always the same for both). Then i need to bind Radius with HTTP (Radius Framed-ip-addr in Accounting the same as HTTP ip source). How to achieve that ?

Thanks,

You can use the

session

Client provides framed IP:

 rule for radius in case client provides the framed IP
when LB_SELECTED {
    log local0. "session table entry added: "
    session add uie "persist:[RADIUS::avp 8]" [LB::server addr]
}

Server provides framed IP:

 rule for radius in case server provides the framed IP
when SERVER_DATA {
    log local0. "session table entry added: "
    session add uie "persist:[RADIUS::avp 8]" [IP::remote_addr]
}

The following one will be bound to your virtual server for HTTP (may be used in context of CLIENT_ACCEPTED as well):

 rule for webservice
when HTTP_REQUEST {
   log local0. "session table lookup result: [session lookup uie "persist:[IP::client_addr]"]"
   if {[session lookup uie "persist:[IP::client_addr]"] ne ""} {
       log local0. "lookup match: [session lookup uie "persist:[IP::client_addr]"]"
       node [session lookup uie "persist:[IP::client_addr]"]
   }
}

I don´t have a RADIUS up and running for testing but replicated it with another service in v11.5.1.

Thanks Stephan,

I guess the solution is near :)

You have shown how to correlate Radius-Accounting with HTTP via IP address. But i also need to correlate Radius-Authentication (udp/1812) with Radius-Accounting (udp/1813) via Calling-station-id.

And this it the challenge - to correlate 3 different protocols using 2 different attributes - all of those need to land on the same node for successful correlation.

Are you able to expand this example ?

Thanks a lot !

Hi,

 rule for RADIUS authentication udp/1812
when LB_SELECTED {
    log local0. "session table entry added: "
    session add uie "persist:[RADIUS::avp 31]" [LB::server addr]
}

 rule for RADIUS accounting udp/1813
when CLIENT_DATA {
   log local0. "session table lookup result: [session lookup uie "persist:[RADIUS::avp 31]"]"
   if {[session lookup uie "persist:[IP::client_addr]"] ne ""} {
       log local0. "lookup match: [session lookup uie "persist:[RADIUS::avp 31]"]"
       node [session lookup uie "persist:[RADIUS::avp 31]"]
   }
}
when SERVER_DATA {
    log local0. "session table entry added: "
    session add uie "persist:[RADIUS::avp 8]" [IP::remote_addr]
}

As initially proposed by cjunior we are using two table entries (keys) pointing to the same real server IP. Thanks, Stephan

Great, for me it's aaa client sending framed-ip, so i would need to add session entry inside CLIENT_DATA, like this:

when CLIENT_DATA {
   log local0. "session table lookup result: [session lookup uie "persist:[RADIUS::avp 31]"]"
   if {[session lookup uie "persist:[IP::client_addr]"] ne ""} {
       log local0. "lookup match: [session lookup uie "persist:[RADIUS::avp 31]"]"
       node [session lookup uie "persist:[RADIUS::avp 31]"]
       session add uie "persist:[RADIUS::avp 8]" [IP::remote_addr]
   }
}

Can it work ? I have tried to do the same using persistence only (no sessions) and found out that it can not work together (thread: https://devcentral.f5.com/questions/irule-two-persist-commands)

Thanks, Michal

Hi Stephan,

OK, i have made several more tests, i have one VS for both Radius Authentication and Accounting. Irule for that:

 rule for RADIUS authentication udp/1812
when LB_SELECTED {
    log local0. "session table entry added: "
    session add uie "persist:[RADIUS::avp 31]" [LB::server addr]
}

 rule for RADIUS accounting udp/1813
when CLIENT_DATA {
   log local0. "session table lookup result: [session lookup uie "persist:[RADIUS::avp 31]"]"
   if {[session lookup uie "persist:[IP::client_addr]"] ne ""} {
       log local0. "lookup match: [session lookup uie "persist:[RADIUS::avp 31]"]"
       node [session lookup uie "persist:[RADIUS::avp 31]"]
       log local0. "session table entry added: "
       session add uie "persist:[RADIUS::avp 8]" [IP::remote_addr]
   }
}

When i send Radius Authentication packet i got the logs:

session table entry added: 
session table lookup result: 172.16.34.100

It looks like session is never created, when trying:

root@(f5)(cfg-sync Standalone)(Active)(/Common)(tmos) show sys connection
Really display all connections? (y/n) y
Sys::Connections
172.16.34.102:35200  172.16.34.100:8  172.16.34.102:35200  172.16.34.100:8  icmp  1  (tmm: 0)  none
172.16.34.102:32148  172.16.34.100:8  172.16.34.102:32148  172.16.34.100:8  icmp  6  (tmm: 0)  none
172.16.34.102:42463  172.16.34.101:8  172.16.34.102:42463  172.16.34.101:8  icmp  5  (tmm: 1)  none
172.16.34.102:57314  172.16.34.101:8  172.16.34.102:57314  172.16.34.101:8  icmp  10  (tmm: 0)  none
Total records returned: 4
root@(f5)(cfg-sync Standalone)(Active)(/Common)(tmos) 

I do see only icmp connection which are result of monitoring (probe). My persistence looks like:

root@(f5)(cfg-sync Standalone)(Active)(/Common)(tmos) show /ltm persistence persist-records
Sys::Persistent Connections
hash  0  172.16.33.103:any  172.16.34.100:any  (tmm: 0)
Total records returned: 1

Why the session is never created ? And how can i display/monitor that ?

Also how can i differentiate accounting from authentication in CLIENT_DATA (i would like to search for framed-ip-addr only for accounting packets).

Thanks, Michal