For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

gdoyle's avatar
gdoyle
Icon for Cirrostratus rankCirrostratus
Sep 26, 2018

Maintenance Page iRule and other iRule Conflicting.

The original maintenance page irule is as follows and works by itself:

priority 400
when HTTP_REQUEST { 
    if { [active_members /partition/poolname_pool] < 1 } {
        HTTP::respond 200 content [ifile get "poolname_MaintenancePage_ifile"] noserver "Content-Type" "text/html" "Cache-Control" "no-cache, must-revalidate"
    }
}

However, when this next irule is attached to the VIP, a "Page Cannot Be Displayed" error shows:

when HTTP_REQUEST {
  HTTP::header insert HttpsIndicatorHeader True
}

So the maintenance page works as long as the second irule is not attached to the VIP. It was suggested that I insert "event HTTP_REQUEST disable" after the HTTP::respond line "and add 'Connection' 'Close' to the maintenance page respond command to ensure the connection closes and further requests (which would bypass irules entirely) aren't seen." I just wanted to run this by some smart people as well as verify my syntax. Is it possible someone could review?

priority 400
when HTTP_REQUEST { 
    if { [active_members /partition/poolname_pool] < 1 } {
        HTTP::respond 200 content [ifile get "poolname_MaintenancePage_ifile"] noserver "Content-Type" "text/html" "Cache-Control" "no-cache, must-revalidate" connection close
    }
    event HTTP_REQUEST disable 
}
application delivery
iRules
LTM

1 Reply

  • Lee_Sutcliffe's avatar
    Lee_Sutcliffe
    Icon for Nacreous rankNacreous
    Sep 26, 2018

    You can't add a header after you have issued an HTTP::respond command. This will likely be why you get an error you will need to add a 

    return
    after you have issued the response tp make sure the header isn't added (if this is indeed what you want to happen)

    I have put the two iRules together as given they are relatively simple, there is no need for them to be separate. 

    when HTTP_REQUEST { 
    if {[active_members /partition/poolname_pool] < 1 } {
        HTTP::respond 200 content [ifile get "poolname_MaintenancePage_ifile"] noserver "Content-Type" "text/html" "Cache-Control" "no-cache, must-revalidate"
        return
    }
    HTTP::header insert HttpsIndicatorHeader True
}