Forum Discussion

mm_pen_242283's avatar
mm_pen_242283
Icon for Nimbostratus rankNimbostratus
Sep 05, 2016

Logical operands within Local Traffic Policy

Hi all.   I have a question regarding Local Traffic Policy matching. From F5 Manual I understand, that either logical AND or logical OR can be applied when combining rules or conditions within rul...
application delivery
ASM Advanced WAF
LTM
security
brunocalcado's avatar
brunocalcado
Icon for Nimbostratus rankNimbostratus
Apr 13, 2018

Hello everybody,

 

About this subject, I have a question. Actually, I must deploy the rules below :

 

1 - if * ---> action : use Pool-1

 

2 - if * ---> action : use Pool-2

 

My difficulty here is how to differentiate the path fd/* and /* ? Because if I don't put the correct condition, I think that the "fd/" would be interpretated as part of the stat '' of the path 1, "/*".

 

So, I have some examples. Conditions that selects the Pool-1 :

 

 

 

-----> We have here "fd/", but it doesn't start the path after the url-host, so, it enters in the case of Pool-1.

 

Conditions that selects the Pool-2 :

 

 

 

 

Could you please help me with this ? Is the strategy important here ? The rule that treats the "fd" case must come before the general rule "/" ?

 

Thanks a lot. Best regards.

 

  • svs's avatar
    svs
    Icon for Cirrostratus rankCirrostratus
    Apr 13, 2018

    Basically it's up to your policy strategy, how the policy matches the rules. If your strategy is "first-match", you only need to make sure, that the order of the rules is correct and reflects your needs. So with first-match your rules should look like this:

     

    Rule 1

    Condition 1: Host Header matches

     

    Condition 2: URI starts_with /fd/

     

    Action: Pool2

     

    Rule 2

    Condition 1: Host Header matches

     

    Condition 2: URI starts_with /

     

    Action: Pool1

     

    In this the case the rules will be evaluated by order and the first rule, where the condition matches the current connection, will be processed.

     

    Maybe it would be simpler to understand Rule 2 as the default rule and don't use any conditions. Every policy I create has a default rule at the bottom, without using any conditions and only execute an action.

     

    Hope that helps and makes things more clear.

     

    Greets,

     

    svs

     

  • brunocalcado's avatar
    brunocalcado
    Icon for Nimbostratus rankNimbostratus
    Apr 13, 2018

    Thanks a lot Sven. I will test on monday. Your solution with de default rule can help me a lot.

     

    Have a nice weekend. BC