For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

RonaldV_224653's avatar
RonaldV_224653
Icon for Nimbostratus rankNimbostratus
Dec 20, 2018

iRule point to a different VS when HTTP_Request matches

Hi All,

At this moment we have an rule as following:

when HTTP_REQUEST {
 if { ([HTTP::uri] starts_with "/corporate/" ) && ( [active_members [LB::server pool]] > 0)}  {
        persist none
        pool POOL.corporate.nl.prod

 If the POOL.tui.nl.prod is "down" the client will be send to the "POOL.PrimarySorryFarm" pool             
} elseif { ([HTTP::uri] starts_with "/corporate/" ) && ( [active_members [LB::server pool]] < 1)}  {
        persist none
        pool POOL.PrimarySorryFarm
        log local0. "Client [IP::client_addr]:[TCP::client_port] -corporate Redirect naar sorry pool!"

}  else {
        persist source_addr 255.255.255.255 1800
        pool POOL.arke.nl.prod

But now we want to not point that traffic to a pool but to a different server because for that http_request we need to SNAT the traffic.

In the documentation of HTTP_REQUEST I only see options to point it to a pool or node and not to an other vs.

Any suggestions?

iRules
LTM
security
snat

2 Replies

  • Dan_Bowman_2434's avatar
    Dan_Bowman_2434
    Icon for Altocumulus rankAltocumulus
    Dec 20, 2018

    instead of pool just use virtual:

    if { ([HTTP::uri] starts_with "/corporate/" ) && ( [active_members [LB::server pool]] > 0)}  {
    persist none
    virtual virtualname
    }
  • Rico's avatar
    Rico
    Icon for Cirrus rankCirrus
    Dec 20, 2018

    Ronald,

    If your only issue is that you need SNAT enabled on certain URI paths, you could use the 'snat' command as shown below:

     if { ([HTTP::uri] starts_with "/corporate/" ) && ( [active_members [LB::server pool]] > 0)}  {
        persist none
        pool POOL.corporate.nl.prod
        snat automap
}

    The 'snat' command can utilize SNAT automap, SNAT pools, and can also SNAT to any address specified in the iRule.

    Hope this helps.