For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

cjunior_138458's avatar
cjunior_138458
Icon for Altostratus rankAltostratus
Nov 26, 2015

LTM Policy http-reply issue

Hi,

We are trying to migrate to v12 and we are facing a problem about the SOL14996 that is working fine in v11.6: Even setting the host part as static, we can't see the [HTTP::uri] being replaced. 

create ltm policy test_policy rules add { https_reply { actions add { 0 { http-reply redirect location https://mysite.net[HTTP::uri] } } } } strategy first-match  requires add { http } controls add { forwarding }

BIG-IP response:
HTTP/1.0 302 Found
Location: https://mysite.net[HTTP::uri]
Server: BigIP
Connection: close
Content-Length: 0

This is a SOL14996 example that fails in v12 (v11.6 is ok): 

create /ltm policy myHTTPtoHTTPSpolicy controls add { forwarding } requires add { http } strategy first-match rules add { myHTTPtoHTTPSrule { actions add { 0 { http-reply redirect location "https://[getfield [HTTP::host] \":\" 1][HTTP::uri]" } } } }

01071748:3: Policy '/Common/myHTTPtoHTTPSpolicy', rule 'myHTTPtoHTTPSrule'; invalid url, value 'https://[getfield [HTTP::host] ":" 1][HTTP::uri]'.

So, I really don't want to rewrite this in iRule, but for now I can't see another way.

Is it a BUG or needs some trick?

Thank you!

application delivery
LTM

5 Replies

  • cjunior's avatar
    cjunior
    Icon for Nacreous rankNacreous
    Nov 26, 2015

    Hi,

    Sorry about that, I solved this problem as follows:

    http-reply request redirect location"tcl:[concat https://[getfield [HTTP::host] \":\" 1][HTTP::uri]]"

    So obvious! 🙂

    Thank you so much!

  • Anthony_Bundy_5's avatar
    Anthony_Bundy_5
    Icon for Nimbostratus rankNimbostratus
    Sep 12, 2016

    There is currently a new solution article published (SOL26312346) with the appropriate syntax for v12.x, including the use of tcl: before using any tcl variables (e.g. HTTP::uri). This only applies to the GUI input to create the LTM policy.

     

  • Ichnafi's avatar
    Ichnafi
    Icon for Cirrostratus rankCirrostratus
    Sep 28, 2016

    I was not aware that there is another option to do a redirection, next to the build in iRule "_sys_https_redirect". We are using this iRule since 11.5 (and also on our 12.1.1 testing machines).

     

    So here's my question: Why not using this iRule? Are there any downsides in iRules compared to a policy solution? I mean, the code is basically the same, but adding an iRule takes less clicks. (Don't get me wrong, my question is meant seriously).

     

  • Ichnafi_177360's avatar
    Ichnafi_177360
    Icon for Nimbostratus rankNimbostratus
    Sep 28, 2016

    I was not aware that there is another option to do a redirection, next to the build in iRule "_sys_https_redirect". We are using this iRule since 11.5 (and also on our 12.1.1 testing machines).

     

    So here's my question: Why not using this iRule? Are there any downsides in iRules compared to a policy solution? I mean, the code is basically the same, but adding an iRule takes less clicks. (Don't get me wrong, my question is meant seriously).

     

    • Kai_Wilke's avatar
      Kai_Wilke
      Icon for MVP rankMVP
      Sep 28, 2016

      Hi Ichnafi,

       

      using LTM Policy or iRules is most likely just a personal preference. From a technical standpoint are LTM Policies a little faster during execution, but on the other site more limited than iRules.

       

      Cheers, Kai