For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

cgwin12's avatar
cgwin12
Icon for Altostratus rankAltostratus
Apr 25, 2024

Need help on i-rule to specific uri path

Hello All,   I'm working on an i-rule that I need to do the following; given a set of specific source ip addresses, only allow access to specific uris of /ws/rest/external*.    I set the specific...
application delivery
event
security
zamroni777's avatar
zamroni777
Icon for MVP rankMVP
May 24, 2024

because the "else" is basicaly reject, you can just simply assing the pool to the virtual server and bind below traffic policy to the virtual server.

it is better to use local traffic policy instead of irules scripting due to better performance and avoid scripting typo.

 

 

  • cgwin12's avatar
    cgwin12
    Icon for Altostratus rankAltostratus
    May 28, 2024

    Thanks, zamroni. I realized I needed to add some additional lines, per F5s recommendation for software releases after v14. This is per https://my.f5.com/manage/s/article/K23237429.

    I like your suggestion about the local traffic policy. I will try that next time I get these requests. 

     

    So it works with my i-rule as shown:

    when CLIENT_ACCEPTED {
      if { [class match [IP::client_addr] equals Boomi_external] } {
         pool esd-bmapi-dc1-as01-f5.lanl.gov_8077_pool
    }
    }

    when HTTP_REQUEST {
     if ![HTTP::has_responded] {
                      switch -glob [string tolower [HTTP::uri -normalized]] {
                          "/ws/rest/external*" {
                if { [class match [IP::client_addr] equals Boomi_external] } {
                                     pool esd-bmapi-dc1-as01-f5.lanl.gov_8077_pool
                                              } else { 
                 reject
                  } log local0. "HTTP::reject_reason"
                          } default {
                        log local0. "HTTP Headers = [HTTP::host], [HTTP::uri]"
                        return
                          }
    }
             }
          }