Forum Discussion
Need help with an Irule
Hi,
We have request that when user from diferent source IP subnets ( for eg: 10.10.10.0/24 , 20.20.20.0/24 and 30.30.30.0/24) hits the F5 VIP IP, VIP needs to respond back from specific tier (web/app) servers.
For eg: if a dns request comes from source Ip subnet 10.10.10.0/24, VIP should respond back from web servers only
For eg: if a dns request comes from source Ip subnet 20.20.20.0/24, VIP should respond back from App servers only
Could someone help me on this? I know this requires an IRule and need help with that.
Any help would be appreciated.
7 Replies
- Dinesh_22825
Nimbostratus
You can create datagroups, 2 pools something like web pool and app pool and validate source IP with that datagroup using irule. Once validation is successful you can redirect it to the pool accordingly.
Check if client IP is part of datagroup when HTTP_REQUEST { if { [matchclass [IP::client_addr] equals ]}{ pool } }- Srini_Vaiyapuri
Nimbostratus
Thanks Dinesh. - Srini_Vaiyapuri
Nimbostratus
Hi Dinesh, Thanks again for your answer earlier. I have another question on this. Looks like data group list is available only in LTM, is there similar feature available in GTM? We have servers in different data centers so need to implement Irule in GTM. Please let me know. Thanks-Srini
- Amy_123193Historic F5 Account
A few things to add:
- the matchclass command is deprecated - the class command should be used instead
- you could use IP::addr instead of data groups, but it will be more difficult to add additional IPs in the future if you need to. for example:
if { [IP::addr [IP::client_addr] equals 10.10.10.0/24] } - string multiple comparisons using elseif
- Srini_Vaiyapuri
Nimbostratus
Thanks Amy. Is Data Group option available in GTM? just realized that end servers are spread across in 2 different data centers, so i would need to configure wide IP list and assign LTMs VIP as virtual servers. In this case, I would require an Irule in GTM to filter the source traffic?? will this work??
- awilhelm
Employee
A few things to add:
- the matchclass command is deprecated - the class command should be used instead
- you could use IP::addr instead of data groups, but it will be more difficult to add additional IPs in the future if you need to. for example:
if { [IP::addr [IP::client_addr] equals 10.10.10.0/24] } - string multiple comparisons using elseif
- Srini_Vaiyapuri
Nimbostratus
Thanks Amy. Is Data Group option available in GTM? just realized that end servers are spread across in 2 different data centers, so i would need to configure wide IP list and assign LTMs VIP as virtual servers. In this case, I would require an Irule in GTM to filter the source traffic?? will this work??
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com