For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

TNY_122436's avatar
TNY_122436
Icon for Nimbostratus rankNimbostratus
May 08, 2014

iRule redirects causing pool member issues

Hi everyone, I have an iRule that works accordingly to what it was intended to do. The problem is that when the VIP which contains this irule shows the VIP (Green) up when the pool members are actually brought down. I have verified that this irule is causing this weird issue. I had removed the irule and the VIP did go down accordingly. If the irule is applied, the VIP stays up. Does anyone know why this irule is causing this? Here is my setup:

 

VIP information: Default Pool: Windows_pool

 

iRule:

 

Code
    when HTTP_REQUEST {

    if { not ([HTTP::host] starts_with "www.") } {  
            HTTP::redirect https://www.[getfield [HTTP::host] ":" 1][HTTP::uri]  

    }
    elseif {[HTTP::uri] starts_with "/ChaptOne/Page1/Blue/" and [HTTP::uri] contains "/HAPPY" and not ([HTTP::uri] contains         "/ABC" or [HTTP::uri] contains "/CDE")} {
    HTTP::respond 301 location "https://www.mainpage.com/chapter4"

    } else {
switch -glob [HTTP::uri] {
    "/Sunday*" -
    "/Monday*" -
    "/Tuesday*" -
    "/Wednesday" -
    "/Thursday*" { 
    pool Unix_pool 
}
    default { 
    pool Windows_pool 
    }   
    }
        }
    }

Code
application delivery
devops
iRules

4 Replies

  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    May 08, 2014

    Presumably because the rule contains the HTTP::redirect and ::respond commands and thus the VS can still 'handle' traffic? I'm only guessing and had no idea things were quite so sophisticated. Perhaps try commenting those bits out and see if things change?

     

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    May 08, 2014

    I believe this is a known condition because you're assigning pools within the iRule. If you just need the VIP to show red, perhaps to trigger a GTM monitor, then you'd probably need to use an iCall or user_alert.conf script to manage VIP viability.

    If, however, you just need to make sure you're not load balancing to downed pools, something like the following may help (a minor modification of your iRule):

    when HTTP_REQUEST {
    if { not ( [HTTP::host] starts_with "www.") } {  
        HTTP::redirect https://www.[getfield [HTTP::host] ":" 1][HTTP::uri]  
    } elseif { ( [HTTP::uri] starts_with "/ChaptOne/Page1/Blue/" ) and ( [HTTP::uri] contains "/HAPPY" ) and not ( ( [HTTP::uri] contains "/ABC" ) or ( [HTTP::uri] contains "/CDE" ) ) } {
        HTTP::respond 301 location "https://www.mainpage.com/chapter4"  
    } else {
        switch -glob [HTTP::uri] {
            "/MyRx*" -
            "/Monday*" -
            "/Tuesday*" -
            "/Wednesday" -
            "/Thursday*" {
                if { [active_members Unix_pool] < 1 } {
                     ...do something here... (splash maintenance page?)
                } else {
                    pool Unix_pool
                }
            }
            default { 
                if { [active_members Windows_pool] < 1 } {
                     ...do something here... (Splash maintenance page?)
                } else {
                    pool Windows_pool
                }                   
            }   
        }
    }
}
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    May 08, 2014

    iCall is for 11.4. I'm only on 11.2. Is there any other way around this besides having to upgrade?

     

    If you look at step 3 in the link, that's the basis of using a raw user_alert.conf config. Just execute your TMSH call in that exec command= section.

     

    Do you think if we remove the pools in the iRule and replace them with a URL, will this issue be mitigated?

     

    Do you mean URI's (different paths on the same web server), or URLs (as in a 30x redirect)?