For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jwhitene's avatar
jwhitene
Icon for Nimbostratus rankNimbostratus
Feb 02, 2017

iRule to check if request comes from any node, any pool, or from list of pools or nodes.

Right now I have an iRule that does this: when CLIENT_ACCEPTED { Check if the client IP address is a node in the VIP's default pool if {[matchclass [IP::client_addr] equals [active_nodes -list...
application delivery
BIG-IP
iRules
Kai_Wilke's avatar
Kai_Wilke
Icon for MVP rankMVP
Feb 03, 2017

Hi jwhitene,

I'm using the iRule below to selectively enable SNAT for connection where the client and the pool member is hosted in the same subnet (via /CIDR mask). Its a much more universal approach which doesn't require any Data-Groups and 

[active_node]
queries...

when LB_SELECTED {
    if { [IP::addr [getfield [IP::client_addr] "%" "1"]/24 equals [getfield [LB::server addr] "%" "1"]/24] } then {
        snat automap
    }   
}

Cheers, Kai