For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Ashok_01_133435's avatar
Ashok_01_133435
Icon for Nimbostratus rankNimbostratus
Sep 12, 2013

Is this irule effecting persistence if called for any VIP

Can someone help me if this irule is effecting the persistence if called for any VIP?

when LB_SELECTED {

It checks whether the IP address is within the class group preloaded with IP addresses that need to validate, you can put host or network

if { [class match [IP::client_addr] equals "source_ip_addr" ] } then {

Is written to the log for review by ssh with the following command: tail -f /var/log/ltm
            log local0. "Source Ip Adress [IP::client_addr], Server Selected [LB::server]"

} }

3 Replies

  • The rule you've presented (slightly modified):

    when LB_SELECTED {
         It checks whether the IP address is within the class group preloaded with
         IP addresses that need to validate, you can put host or network
        if { [class match [IP::client_addr] equals source_ip_addr ] } {
             Is written to the log for review by ssh with the following command:
            tail -f /var/log/ltm
            log local0. "Source Ip Adress [IP::client_addr], Server Selected [LB::server]"
        } 
    }
    

    only logs the source address and the chosen pool member IF the source address matches an IP/subnet in your data group (source_ip_addr). What do you need it to do?

  • Here it is reformatted. Create a new iRule in the management GUI and copy/paste below.

    when HTTP_REQUEST { 
        switch -glob [HTTP::path] { 
            "/Microsoft-Server-ActiveSync*" { 
                 Direct all ActiveSync clients to a common pool; use 
                 HTTP cookie persistence persist cookie 
                pool Outlook2010_combined_vs_as_pool 
            } 
            "/rpc/rpcproxy.dll" { 
                 Grab all requests for Outlook Anywhere; the following 
                 checks assign correct persistence methods. 
                switch -glob [HTTP::header "User-Agent"] { 
                "MSRPC" { 
                     This User-Agent section matches most versions of 
                     Outlook and Windows using Outlook Anywhere. 
                     The OutlookSession cookie is new to Outlook 2010. 
                    if { [HTTP::cookie exists "OutlookSession"] } { 
                        persist uie [HTTP::header "OutlookSession"] 3600 
                    } else { 
                        persist uie [HTTP::header "Authorization"] 3600 
                    } 
                } 
                "*Microsoft Office*" { 
                     This section matches some versions of 
                     Outlook 2007 on Windows XP 
                    persist uie [HTTP::header "Authorization"] 3600 
                } 
                default { 
                     This section catches all other requests for 
                     Outlook Anywhere, and sets a persistence method 
                     that does not require the client to support 
                     HTTP cookies 
                    persist source_addr 
                } 
            } 
             Finally, this assigns the Outlook Anywhere pool and turns 
             off full HTTP parsing and compression. If the preceding 
             clients should be sent to separate pools, the pool statement 
             should be removed here, and a separate pool statement 
             placed in each of the preceding logic branches. 
             Other modules (APM, ASM, etc.) should be disabled here 
             as well, if active for other traffic though this virtual 
             server. 
            pool Outlook2010_combined_vs_oa_pool 
            CACHE::disable 
            HTTP::disable 
            COMPRESS::disable 
        } 
        "/xml/autodiscover.aspx" { 
             Requests for Autodiscovery information. The selected pool 
             might be unique, or might be the same as e.g. your pool 
             for OWA or ActiveSync. In this example, we use the same 
             pool that receives ActiveSync traffic. 
            persist source_addr 
            pool Outlook2010_combined_vs_ad_pool 
        } default { 
             This final section takes all traffic that has not 
             otherwise been accounted for and sends it to the 
             pool for Outlook Web App 
            persist source_addr  
            pool Outlook2010_combined_vs_owa_pool 
        } 
    }
    

    ** I should add that I haven't tested this complete rule.

    }