For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Richert_299760's avatar
Richert_299760
Icon for Nimbostratus rankNimbostratus
Jul 14, 2017

LTM Monitor or iRule to disable pool based on DNS query results

I have 2 data centers with LTMs and GTMs in each. The GTM resolves queries in a round-robin fashion to distribute traffic between the 2 data center's LTM VIPs. Occasionally, I want to change the configuration on the GTM to force traffic to only one data center. However, some of my client connections do not query DNS until the TCP connection is broken (e.g. Syslog sending traffic to a load balanced RSyslog Server). When I change the configuration on the the GTM to send all traffic to DC-2, the clients stay connected to the LTM VIP in DC-1. I would like to have an LTM Monitor or iRule on the LTM that occasionally queries DNS to see if connections should be dropped at the LTM. My LTM Pools have the "Action on Service Down" setting set to "REJECT". So all I need to do is disable and re-enable the pool to force a TCP reset to be sent to the client to break the connections, which will force the clients to reconnect to the VIP in DC-2.

 

What is the best way to implement a monitor or iRule that will query DNS and then disable the pool and re-enable it immediately when the DNS Query response is not my local LTM VIP assigned to this pool (i.e. sending a TCP Reset to the clients)?

 

If something can be done at GTM to trigger the LTM to disable and re-enable the pool, that would work also, but I think the logic will be best implemented on the LTM.

 

No RepliesBe the first to reply