For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

chungyu_16122's avatar
chungyu_16122
Icon for Altostratus rankAltostratus
Nov 17, 2015

iRule to support Cisco Finesse

Hi all

 

I am trying to setup a load balancing service for cisco finesse, I sentimentally need to redirect a VIP host name to a server name.

 

A basic redirect irule works fine for this part:

 

when HTTP_REQUEST { switch -glob [string tolower [HTTP::host]] { "finesse.domain.school.ca" { HTTP::redirect "https://ccxsrv1.domain.school.ca:8445" } } }

 

But if the server ccxsrv.domain.school.ca is down, I want the redirect to go to https://ccxsrv2.domain.school.ca:8445

 

I put each server in a separate pool and created a rule that looks at the pool monitor. If the server in pool 1 is down redirect to server 2.

 

when HTTP_REQUEST { switch -glob [string tolower [HTTP::host]] { "finesse.domain.school.ca" { HTTP::redirect "https://ccxsrv1.domain.school.ca:8445" } if { [active_members Finesse_CCX] < 1} { HTTP::redirect https://ccxsrv2.domain.school.ca:8445" } } }

 

I think the logic is correct but when I run the rule, it fails, not even the first redirect works when server is up.

 

Has anyone had experience with Cisco Finesse?

 

Thanks in advance

 

Chung

 

application delivery
BIG-IP
iRules

4 Replies

  • cjunior's avatar
    cjunior
    Icon for Nacreous rankNacreous
    Nov 18, 2015

    Hi,

    I have no experience with cisco, but looks like have some problem in your iRule, could you try this way? 
    when HTTP_REQUEST { 
    switch -glob [string tolower [HTTP::host]] { 
        "finesse.domain.school.ca" { 
            check pool Finesse_CCX that serves ccxsrv1
            if { [active_members Finesse_CCX] > 0 } { 
                HTTP::redirect "https://ccxsrv1.domain.school.ca:8445" 
            } else {
                HTTP::redirect "https://ccxsrv2.domain.school.ca:8445" 
            }
        } 
    }
}
  • chungyu_16122's avatar
    chungyu_16122
    Icon for Altostratus rankAltostratus
    Nov 19, 2015

    HI there

     

    Thanks alot for the quick response. I have tried this iRule but it does not work. ON the VS, I am not listing any pool at all just a straight redirect. It seems with the Cisco product, trying to pass the traffic thru the LB and to the server causes a strange problem on the client side. Normally we target server:8445 but when we use the LB to send to a server in a pool, the client sends back a connection on port 7443. This is typically used by another process in Finesse.

     

    But if I just redirect to the server via a iRule, everything works fine. But if the primary server goes away, I do not have a way of dynamically sending traffic to the alternate server.

     

    I have created a iRule for each server, if there was a way to dynamically change the irule on detection of a failure, then that would be optimal.

     

    Chung

     

    • cjunior's avatar
      cjunior
      Icon for Nacreous rankNacreous
      Nov 19, 2015
      In this case it would be fundamental to know what you expect and the connection flow for setup, sorry, it's cloudy for me.
  • chungyu_16122's avatar
    chungyu_16122
    Icon for Altostratus rankAltostratus
    Nov 19, 2015

    HI there

     

    Thanks alot for the quick response. I have tried this iRule but it does not work. ON the VS, I am not listing any pool at all just a straight redirect. It seems with the Cisco product, trying to pass the traffic thru the LB and to the server causes a strange problem on the client side. Normally we target server:8445 but when we use the LB to send to a server in a pool, the client sends back a connection on port 7443. This is typically used by another process in Finesse.

     

    But if I just redirect to the server via a iRule, everything works fine. But if the primary server goes away, I do not have a way of dynamically sending traffic to the alternate server.

     

    I have created a iRule for each server, if there was a way to dynamically change the irule on detection of a failure, then that would be optimal.

     

    Chung