iRules Blocking Traffic

Hi,

the condition

([HTTP::uri] equals "soaprod.corp.unifirst.com")

it must be

([HTTP::host] equals "soaprod.corp.unifirst.com")

do not create condition like :

a or b and c

but

(a or b) and c

Hi UniFirst,

your iRule is almost identical with the provided example of: https://devcentral.f5.com/wiki/iRules.IP__idle_timeout.ashx

Stanislav already told you how to combine AND & OR operators to chain multiple conditions in a single [if].

The connection reset you're experiencing may occour because the variable $serverside_idle_timeout is not alway set and therefor may break your connection. The provided example contains an additional [info exist] error handle within SERVER_CONNECTED event to check if the variable $serverside_idle_timeout is set right before accessing it.

Cheers, Kai

You did not set the serverside_idle_timeout to 0 as default value...

so it raise a tcl error...

2 solutions:

when HTTP_REQUEST {
    set serverside_idle_timeout 0
    if { ([IP::addr [IP::client_addr] equals 172.17.101.60] or [IP::addr [IP::client_addr] equals 172.17.101.149]) and ([HTTP::host] equals "soaprod.corp.unifirst.com") }  { log local0. "original timeout: [IP::idle_timeout]"
        IP::idle_timeout 10800
        log local0. "updated timeout: [IP::idle_timeout]"
        set serverside_idle_timeout 1
    }
}
when SERVER_CONNECTED {
    log local0. "original timeout: [IP::idle_timeout]"
    if {$serverside_idle_timeout} {
        IP::idle_timeout 10800
        log local0. "updated timeout: [IP::idle_timeout]"
    }
}

or

when HTTP_REQUEST {
    if { ([IP::addr [IP::client_addr] equals 172.17.101.60] or [IP::addr [IP::client_addr] equals 172.17.101.149]) and ([HTTP::host] equals "soaprod.corp.unifirst.com") }  { log local0. "original timeout: [IP::idle_timeout]"
        IP::idle_timeout 10800
        log local0. "updated timeout: [IP::idle_timeout]"
        set serverside_idle_timeout 1
    }
}
when SERVER_CONNECTED {
    log local0. "original timeout: [IP::idle_timeout]"
    if {([info exists serverside_idle_timeout]) && ($serverside_idle_timeout)} {
        IP::idle_timeout 10800
        log local0. "updated timeout: [IP::idle_timeout]"
    }
}

Thank you all. I set an If info and all is good now. Thanks again to all.