For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Jace_45978's avatar
Jace_45978
Icon for Nimbostratus rankNimbostratus
Mar 19, 2012

persistence based on uri call

would like to add persistence profile if client makes call with /admin in the uri to the VS otherwise there is no persistence on the VIP.

 

I plan on adding a universal persistence to the VS with this following iRule can someone let me know if i am on track?

 

 

client makes call to https:///dispatch/admin/StartAdmin.html

 

 

virtual fp230 {

 

snat automap

 

pool ds-8080

 

destination 10.10.10.10:https

 

ip protocol tcp

 

profiles {

 

fp230-stg_sslprofile {

 

clientside

 

}

 

http {}

 

tcp {}

 

}

 

}

 

 

profile persist f3p_35min_persist {

 

defaults from source_addr

 

mode source addr

 

timeout 2100

 

}

 

 

thinking the irule would look like this??

 

 

when HTTP_REQUEST {

 

if { [URI::path] contains "/admin" } {

 

persist f3p_35min_persist }

 

}
application delivery
dev
devops
iRules

6 Replies

  • koenning_107182's avatar
    koenning_107182
    Icon for Nimbostratus rankNimbostratus
    Mar 20, 2012
    Hi Jace,

    this looks good so far, the irule should look like this: 

     
when HTTP_REQUEST {
        if { [HTTP::uri] starts_with "/admin" } {
               persist source_addr 255.255.255.255 2100    
}
}

    If the clients accessing this application are not behind any form of nat, it can be a good solution.

    However, it is always better to persist higher up the stack, just in case.

    Is there any cookie you could hook up on ? If not, are you allowed to set a cookie ?

    Thanks,

    Christian
  • Jace_45978's avatar
    Jace_45978
    Icon for Nimbostratus rankNimbostratus
    Mar 20, 2012
    we are unable to persist based off cookie. This is one of those VS that the only persistence they want is when they go to the admin console.

     

    I noticed that my previous post http string didn't post correctly.

     

    The call the client makes is https://VS_server.com/dispatch/admin/StartAdmin.html all other non admin console calls would be https://VS_server.com/dispatch/somethingelse.html

     

    That is why i was thinking of putting the "contains" in the irule.

     

    No natting. thanks for the input.

     

     

  • koenning_107182's avatar
    koenning_107182
    Icon for Nimbostratus rankNimbostratus
    Mar 20, 2012
    Hi Jace,

    makes sense. Based on your input, the irule should look like 

    when HTTP_REQUEST {
        if { [HTTP::uri] equals "/dispatch/admin/StartAdmin.html" } {
               persist source_addr 255.255.255.255 2100    
        }
}

    Means only when starting the admin console at that specific path, a persistence record is created.

    Thanks

    Christian
  • Jace_45978's avatar
    Jace_45978
    Icon for Nimbostratus rankNimbostratus
    Mar 20, 2012
    Great thanks Christian. I we will be implementing this rule tomorrow I will let you know if there are any issues. I appreciate your input!
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Mar 21, 2012
    I think the persist command might stay in effect for the rest of the connection. So you might want to disable persistence for non-matching URIs: 

    
when HTTP_REQUEST {
   if { [HTTP::uri] equals "/dispatch/admin/StartAdmin.html" } {
      persist source_addr 255.255.255.255 2100    
   } else {
      persist none
   }
}

    Aaron
  • kunalPatel_3157's avatar
    kunalPatel_3157
    Icon for Cirrus rankCirrus
    Oct 25, 2018

    I actually have a follow-up

    I have following irule:

    when HTTP_REQUEST {

    if { ([HTTP::uri] contains  "Communication") or ([HTTP::uri] contains  "Builder") }{

           persist cookie
           pool XYZ

    }
 elseif { ([HTTP::uri] contains  "PDFTemp") or ([HTTP::uri] contains  "DOCTemp") or ([HTTP::uri] contains  "Servicenew") or ([HTTP::uri] contains  "ServiceCorrespondence")}{ 
             log local0. "Client IP = [IP::client_addr]"  
             persist none
             pool ABC
    }

    }

    But I am not still seeing Persistence on second pool ABC and I had to put the Persistence method cookie on Virtual servers Resources, Default Persistence Profile Section.

    If I don't put that on the Virtual server, it gives an error that irule is using Persistence method so VS needs to have "cookie" in VS > Resources > Default Persistence Profile Section : "Cookie"