iRule to route traffic to different pool when pool members down in default pool

Question

Greetings,We are running a transparent proxy in our environment and have decided that when the both proxy servers in our proxy server pool become unavailable we would like to route the traffic out the internet unfiltered (VLAN C).  All clients have public IPv4 addresses.&nbsp;&nbsp;&nbsp;I have a wildcard VIP setup (with a lasthop pool overriding the autolast hop featuere) to accept traffic on VLAN A pass the traffic back to VLAN B (where the proxy servers are) and then go out the lasthop pool on VLAN C.&nbsp;&nbsp;&nbsp;I have an iRule on the wildcard VIP which redirects HTTP requests to the proxy server when needed by replacing the HTTP host and HTTP uri.&nbsp;&nbsp;&nbsp;When the proxy servers are not down this setup works flawlessly.  However when both proxy servers are down and I choose to use the lasthop pool instead of the proxy pool traffic does not flow correctly.  If I remove both the iRule with the HTTP redirects in it and the HTTP profile and apply a iRule with just when LB::failed statement in it to reselect the lasthop pool as it's target I can asymetrically route the traffic to the internet just fine.  This makes me believe that there is something in the HTTP profile (possibly iRule) which is causing a change to the HTTP packet before it goes to the lasthop pool that the router in the lasthop does not like.&nbsp;&nbsp;&nbsp;Any help or suggestions would be great.&nbsp;&nbsp;&nbsp;Configuration:&nbsp;virtual capture_virt {&nbsp;   lasthop pool captured_lasthop&nbsp;   pool capture_pool&nbsp;   destination any:any&nbsp;   mask 0.0.0.0&nbsp;   ip protocol tcp&nbsp;   rules captured-HTTP_rule&nbsp;   profiles {&nbsp;      captured_prof {}&nbsp;      captured_tcp_prof {}&nbsp;   }&nbsp;   vlans captured-A enable&nbsp;}&nbsp;&nbsp;&nbsp;pool captured_lasthop {&nbsp;   monitor all gateway_icmp&nbsp;   members 10.1.5.41:any {}&nbsp;}&nbsp;&nbsp;&nbsp;____iRule below__________&nbsp;&nbsp;&nbsp;rule captured-HTTP_rule {&nbsp;   when CLIENT_ACCEPTED {&nbsp;        if { [active_members capture_pool] &lt; 1 } {&nbsp;        use pool captured_lasthop                                                &nbsp;        }&nbsp;        }&nbsp;   when LB_FAILED {&nbsp;        if { [active_members capture_pool] &lt; 1 } {&nbsp;        use pool captured_lasthop                                                &nbsp;        }&nbsp;        }&nbsp;   when HTTP_REQUEST {&nbsp;   if { [HTTP::host] eq "www.facebook.com" } {&nbsp;      use pool captured_lasthop                                                  &nbsp;   } elseif { [HTTP::host] eq "www.google.com" } {&nbsp;      use pool captured_lasthop                                                  &nbsp;   } elseif { [HTTP::host] eq "www.yahoo.com" } {&nbsp;      use pool captured_lasthop                                                  &nbsp;   } else {&nbsp;      log local0. "Client IP address is: [IP::remote_addr]"&nbsp;      HTTP::header replace Host "www.example.com"&nbsp;      log local0. "Replacing Host"&nbsp;      HTTP::uri "/example/login.html"&nbsp;      log local0. "Replacing URI"&nbsp;   }&nbsp;  }&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;_____iRule above______&nbsp;&nbsp;&nbsp;pool capture_pool {&nbsp;   monitor all cp-web_HTTP_DEV01_mon&nbsp;   members {&nbsp;      10.1.5.20:http {}&nbsp;      10.1.5.21:http {}&nbsp;   }&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;profile http captured_prof {&nbsp;   defaults from http&nbsp;}&nbsp;&nbsp;&nbsp;profile tcp captured_tcp_prof {&nbsp;   defaults from tcp&nbsp;}&nbsp;&nbsp;

nitass · Answer

However when both proxy servers are down and I choose to use the lasthop pool instead of the proxy pool traffic does not flow correctly.can you try to put "forward" command above pool captured_lasthop?

nick_68106 · Answer

Greetings nitass, 
&nbsp; I inserted 'forward' above the pool selection like so in the iRule: 
&nbsp;  
&nbsp; rule captured-HTTP_rule { 
&nbsp;    when CLIENT_ACCEPTED { 
&nbsp;         if { [active_members capture_pool] &lt; 1 } { 
&nbsp;         use pool captured_lasthop                                                 
&nbsp;         } 
&nbsp;         } 
&nbsp;    when LB_FAILED { 
&nbsp;         if { [active_members capture_pool] &lt; 1 } { 
&nbsp;         use pool captured_lasthop                                                 
&nbsp;         } 
&nbsp;         } 
&nbsp;  
&nbsp; The outcome is still the same.

nitass · Answer

is it similar to this? but it still doesn't work, does it? 
  
 when CLIENT_ACCEPTED { 
   if { [active_members capture_pool] &lt; 1 } { 
      forward
      pool captured_lasthop 
   } 
} 
when LB_FAILED { 
   if { [active_members capture_pool] &lt; 1 } { 
      forward
      pool captured_lasthop 
   } 
}

nick_68106 · Answer

Yes sorry, copy paste fail there.  It is identical to what you have posted and still does not work.

nitass · Answer

never mind. forward command is not needed in your configuration.&nbsp;
&nbsp;by the way, can you try to also check active members in HTTP_REQUEST? &nbsp;
&nbsp;e.g. &nbsp;
&nbsp;when HTTP_REQUEST {
&nbsp; switch [string tolower [HTTP::host]] {
&nbsp;  "www.facebook.com" -
&nbsp;  "www.google.com" -
&nbsp;  "www.yahoo.com" {
&nbsp;   pool captured_lasthop                                                  
&nbsp;  }
&nbsp;  default {
&nbsp;   if {[active_members [LB::server pool]] &gt; 0} {
&nbsp;    log local0. "Client IP address is: [IP::remote_addr]"
&nbsp;    HTTP::header replace Host "www.example.com"
&nbsp;    log local0. "Replacing Host"
&nbsp;    HTTP::uri "/example/login.html"
&nbsp;    log local0. "Replacing URI"
&nbsp;   }
&nbsp;  }
&nbsp; }
&nbsp;}

F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

iRule to route traffic to different pool when pool members down in default pool

9 Replies

F5 Container Ingress Services (CIS) and using k8s traffic policies to send traffic directly to pods

F5 Architecture Track Sessions - AppWorld 2026

Recent Discussions

Request for Bug Tracker/Known Issues – BIG-IP Version 17.5.1.2

AST Configuration Assistance

Adding logging to APM per-request policy without SWG license

Single LTM with multiple GTM domains

License activation

Related Content

Aswin MK - November 2025 Featured Member

Kostas Injeyan - October 2025 Featured Member

F5 Container Ingress Services (CIS) and using k8s traffic policies to send traffic directly to pods

Differences between Disabled vs. Force Offline (Pool Member)

LTM policy to route traffic to different pools

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS