For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

MW1's avatar
MW1
Icon for Cirrus rankCirrus
Oct 18, 2016

Is it possible to switch the TCP , HTTP compression and web acceleration profile using an irule

All, I am trying to address an issue for users in India accessing USA based systems using a thick client which are being impacted by the latency (approx 250-300ms). I have a virtual server with a HTTP profile using the default TCP profile, performing SSL offloading and load balancing.

 

To be able to test I have been asked to switch the TCP/HTTP compression and web acceleration profile for just a handful of users based on their IP address (i.e. using an irule to match the client IP and then enable different profiles)

 

I have seen older posts stating it is not possible to switch the TCP profile using an irule but thought I would see if anyone is aware if it is now possible, or any other thoughts on a different approach to use if not.

 

thanks in advance

 

application delivery
cloud
iRules
LTM

6 Replies

  • Leonardo_Souza's avatar
    Leonardo_Souza
    Icon for Cirrocumulus rankCirrocumulus
    Oct 18, 2016

    I can see that is possible to disable the compression, but does not look like is possible to change TCP or acceleration profiles.

     

    A simple workaround that should work, is to direct the traffic to another virtual server, and that virtual server would have the new settings you want.

     

    https://devcentral.f5.com/wiki/irules.virtual.ashx

     

    You need to test. Not sure if the TCP profile will change, try in early events in the iRule.

     

    Also, about the decision when to use the new virtual server, just use a datagroup with the IPs/networks.

     

  • Hannes_Rapp_162's avatar
    Hannes_Rapp_162
    Icon for Nacreous rankNacreous
    Oct 18, 2016

    You can change the HTTP Compression and Webacceleraration profile by using a LTM Local Traffic Policy. In regards to modifying the TCP profile, I think you're out of luck.

     

    But what you can do is create a second Virtual Server which has the exact settings you want for your Indian-based customers (second public DNS needed). What you can then do is issue a HTTP redirect from the main Virtual Server/Service to that Indian-specific Virtual Server/Service based on customer's GeoLocation (using an iRule).

     

    • The initial TCP handshake, SSL handshake and L7 HTTP request will still use the settings from your main Virtual Server, but any consequent requests can benefit from your optimized profiles.
    • Over time, your Indian-based customers will refrain from using the main DNS as they are aware of the existence of your second DNS name dedicated for their region.
    • Hannes_Rapp_162's avatar
      Hannes_Rapp_162
      Icon for Nacreous rankNacreous
      Oct 18, 2016

      If you're aiming to just test the benefits of your optimized profiles first, create a second Virtual Server with the same target IP address, but take advantage of the Source IP Address field (closest-match source-IP VIP will get the connection). If you know from which IP address the test connections will be coming from, your test scenario will be very straight forward and there's no need to use any iRules.

       

  • Hannes_Rapp's avatar
    Hannes_Rapp
    Icon for Nimbostratus rankNimbostratus
    Oct 18, 2016

    You can change the HTTP Compression and Webacceleraration profile by using a LTM Local Traffic Policy. In regards to modifying the TCP profile, I think you're out of luck.

     

    But what you can do is create a second Virtual Server which has the exact settings you want for your Indian-based customers (second public DNS needed). What you can then do is issue a HTTP redirect from the main Virtual Server/Service to that Indian-specific Virtual Server/Service based on customer's GeoLocation (using an iRule).

     

    • The initial TCP handshake, SSL handshake and L7 HTTP request will still use the settings from your main Virtual Server, but any consequent requests can benefit from your optimized profiles.
    • Over time, your Indian-based customers will refrain from using the main DNS as they are aware of the existence of your second DNS name dedicated for their region.
    • Hannes_Rapp's avatar
      Hannes_Rapp
      Icon for Nimbostratus rankNimbostratus
      Oct 18, 2016

      If you're aiming to just test the benefits of your optimized profiles first, create a second Virtual Server with the same target IP address, but take advantage of the Source IP Address field (closest-match source-IP VIP will get the connection). If you know from which IP address the test connections will be coming from, your test scenario will be very straight forward and there's no need to use any iRules.