For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Shep_52546's avatar
Shep_52546
Historic F5 Account
Mar 17, 2010

Link Controller Outbound Traffic Source Based

Hi, my customer currently has a Radware Link Proof unit and on one of his load balancing options he is doing somthing similar to Source Based Routing. Essentialy his configuration states that if a server initiates traffic from a specific subnet or host then it will be senst down Link/ISPX

 

 

I can not seem to emmulate this on the Link Controller.

 

 

Any help would appreciated.

 

 

Thanks

 

 

Keiron
config
design

3 Replies

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Mar 17, 2010
    Hi Keiron,

     

     

    You should be able to use an iRule which selects a specific gateway pool member based on the source IP or network. If it's an ingress VLAN that you want to route specifically, you could create a virtual server listening only on that ingress VLAN which points to a custom pool. This latter option would be the simplest and most efficient. If you want an example iRule for the former, check this Codeshare example:

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/AccessControlBasedOnIP

     

     

    and the pool command wiki page:

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/pool

     

     

    Aaron
  • Shep_52546's avatar
    Shep_52546
    Historic F5 Account
    Mar 29, 2010
    Many thanks Aaron that seemed to work a treat, I also played around with a DataGroup and managed to achieve the same result.

     

     

    when CLIENT_ACCEPTED {

     

    if { [matchclass [IP::client_addr] equals $::CA_Server_List] } {

     

    set pool Commercial_Links_Pool

     

    }

     

    }

     

     

    where CA_Server_List is my IP address datagroup.

     

     

    Regards,

     

     

     

    Keiron

     

     

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Mar 29, 2010
    Hi Keiron,

    If you're on 9.4.4 or higher, you can remove the $:: prefix from the datagroup name to make the iRule CMP compliant (Click here). Also, you can use 'pool POOL_NAME' to select a pool: 

     
 when CLIENT_ACCEPTED { 
    if { [matchclass [IP::client_addr] equals CA_Server_List] } { 
       pool Commercial_Links_Pool 
    } 
 }

    Aaron