For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Gilles_MOULIN_2's avatar
Gilles_MOULIN_2
Icon for Nimbostratus rankNimbostratus
Jul 15, 2014

iRule to start conditionnaly oneconnect

Is it possible to create an iRule that would match some specific clients source IP address (WAF farm) and apply accordingly a oneConnect profil ?

 

Idea is to enable connection reuse only for WAF servers (persist on XFF) but not for other basic clients (persist on sourceIP).

 

a try :

 

when CLIENT_ACCEPTED { if {[IP::addr [IP::client_addr] equals 10.2.0.0/16]} { onconnect myOneConnect <==== this -of course- does not works :( } }

 

application delivery
devops
iRules
LTM

2 Replies

  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Jul 15, 2014

    Hi Gilles, Have you taken a look at the following post?

     

    https://devcentral.f5.com/questions/oneconnect-with-irule

     

    -=Bhattman=-

     

  • Gilles_MOULIN_2's avatar
    Gilles_MOULIN_2
    Icon for Nimbostratus rankNimbostratus
    Jul 17, 2014

    Thank you for the reply...

    so the idea is to associate a OneConnect profil to the virtual server and disable the connection reuse when client does not match the expected source :

    when CLIENT_ACCEPTED {
    if { not( [IP::addr [IP::client_addr] equals 10.2.0.0/16] ) } {
        ONECONNECT::reuse disable 
    } 
}

    Correct ?