Forum Discussion

Ben_9010's avatar
Ben_9010
Icon for Nimbostratus rankNimbostratus
Jan 19, 2017

Modify iRule Table through iControlREST ?

Looking to remotely add/remove IPs to a table blacklist that can be referenced by an iRule. Is it possible to accomplish this through iControlREST ?

 

Thanks!

 

iControlREST
iRules
security
  • IheartF5_45022's avatar
    IheartF5_45022
    Icon for Nacreous rankNacreous
    Jan 20, 2017

    Yes you can do that. I've done it before using an external datagroup, and storing the datagroup contents on an external HTTP (or HTTPS) server. Here's the tmsh command;-

    tmsh modify /sys file data-group /Common/dg_ip_blacklist separator ":=" source-path http://10.2.3.4:8080/etc/ip_blacklist.txt

    That doesn't quite get you there though...use the following guide https://devcentral.f5.com/d/icontrol-rest-user-guide-version-1150 to convert the tmsh command into a REST request that can be sent by a remote server....

    • IheartF5_45022's avatar
      IheartF5_45022
      Icon for Nacreous rankNacreous
      Jan 20, 2017

      OK ok

      curl -k -u admin:'blah' -H "Content-Type: application/json" -X PUT -d '{"name":"dg_ip_blacklist","partition":"/Common","source-path": "http://10.2.3.4:8080/etc/ip_blacklist.txt"}' https://10.191.58.180/mgmt/tm/sys/file/data-group/dg_ip_blacklist/?$filter=partition%20eq%20Common

    • IheartF5_45022's avatar
      IheartF5_45022
      Icon for Nacreous rankNacreous
      Jan 20, 2017

      If you'd rather manipulate data group entries individually you can use an internal datagroup and you should be able to use iControl REST to do that too.

       

  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Jan 27, 2017

    Hi Ben,

    you can't change 

    [table]
    data via REST. But you can add/remove data-group entries via REST and then access the data-group via iRules.

    To add/remove entries via REST into/from a data-group without applying the entire data-group again, you can deploy some TMSH helper scripts on your box and call those scripts via REST while passing the required parameters.

    To get an idea how this could be implemented, you may take a look to the post below. It explains how a data-group can be changed within an iRule by using a combo of iRule->SIDEBAND Connection->REST API->TMSH Script->Data-Group. Simply skip the iRule->SIDEBAND part and you should have a working solution within minutes...

    https://devcentral.f5.com/questions/write-into-internal-data-group-from-irule-50597

    Cheers, Kai