Making Google Auth active

Your Check Google Auth should be an empty container and you need to add branch rules based upon what the iRule finds.

Successful - expr { [mcget {session.custom.ga_result}] == 0 } No Google Auth key found - expr { [mcget {session.custom.ga_result}] == 2 } Invalid Google Auth key - expr { [mcget {session.custom.ga_result}] == 3 } User Locked Out - expr { [mcget {session.custom.ga_result}] == 4 } Failback

Only the Successful branch should continue on. In your workflow it all continues so yes no matter what is entered it would continue.