Forum Discussion

cgwin12's avatar
cgwin12
Icon for Altostratus rankAltostratus
Apr 25, 2024

Need help on i-rule to specific uri path

Hello All,   I'm working on an i-rule that I need to do the following; given a set of specific source ip addresses, only allow access to specific uris of /ws/rest/external*.    I set the specific...
application delivery
event
security
zamroni777's avatar
zamroni777
Icon for Nacreous rankNacreous

because the "else" is basicaly reject, you can just simply assing the pool to the virtual server and bind below traffic policy to the virtual server.

it is better to use local traffic policy instead of irules scripting due to better performance and avoid scripting typo.

 

 

cgwin12's avatar
cgwin12
Icon for Altostratus rankAltostratus
May 28, 2024

Thanks, zamroni. I realized I needed to add some additional lines, per F5s recommendation for software releases after v14. This is per https://my.f5.com/manage/s/article/K23237429.

I like your suggestion about the local traffic policy. I will try that next time I get these requests. 

 

So it works with my i-rule as shown:

when CLIENT_ACCEPTED {
  if { [class match [IP::client_addr] equals Boomi_external] } {
     pool esd-bmapi-dc1-as01-f5.lanl.gov_8077_pool
}
}

when HTTP_REQUEST {
 if ![HTTP::has_responded] {
                  switch -glob [string tolower [HTTP::uri -normalized]] {
                      "/ws/rest/external*" {
            if { [class match [IP::client_addr] equals Boomi_external] } {
                                 pool esd-bmapi-dc1-as01-f5.lanl.gov_8077_pool
                                          } else { 
             reject
              } log local0. "HTTP::reject_reason"
                      } default {
                    log local0. "HTTP Headers = [HTTP::host], [HTTP::uri]"
                    return
                      }
}
         }
      }