Forum Discussion

Nimbostratus

May 01, 2019

Policy action getting overwrote by irule

Hello Everyone,

I'm currently using irule to publish application (filtering by URL). At the end of the irule I have a redirect by default.

when HTTP_REQUEST {set path [string tolower [HTTP::path]]
   switch -glob [string tolower [HTTP::host]] {

     "example.com" 
    {
         pool example-com-pool
    }

    default {
        HTTP::respond 301 Location "https://[HTTP::host][HTTP::uri]" 
    }
}

I'm having an issue migrating from irule to ltm policies. I have this rule.

My policy rule is matching (Thanks to the log action).

But the forward traffic action is not working. I'm redirected to https by the default condition of the irule.

So it looks like the irule is overwroting what my policy is doing.

Anyone encountered this issue ?

Thanks!

Gauthier_FRIDIE
May 08, 2019
I found the solution. You can find if a pool is already selected.

[LB::server pool] will give you the name of the pool selected (or nothing) for example: /Common/example-com-pool

So the solution in my case to avoid the default case to overwrite what my policy did.

default { if { ! ([LB::server pool] starts_with "/Common/") } { log local0. "DEBUG – pool not selected" HTTP::respond 301 Location "https://[HTTP::host][HTTP::uri]" } }

NB: For the random googler coming accros this question you can also catch if a redirect was already performed (by your policy) with this ([catch {HTTP::payload replace 0 0 {}}])

Stanislas_Piro2
Cumulonimbus
May 01, 2019
When working with policies and irules, all policies / irules are executed for the same event before action is really applied...

If you assign a policy and an irule to the virtual server, policy code execute first but does not prevent irule execution...

If you don’t want the irule execute, create a tcl variable in policy with value 1 then check if this variable value is 1 in irule...
Gauthier_FRIDIE
Nimbostratus
May 08, 2019
I found the solution. You can find if a pool is already selected.

[LB::server pool] will give you the name of the pool selected (or nothing) for example: /Common/example-com-pool

So the solution in my case to avoid the default case to overwrite what my policy did.

default { if { ! ([LB::server pool] starts_with "/Common/") } { log local0. "DEBUG – pool not selected" HTTP::respond 301 Location "https://[HTTP::host][HTTP::uri]" } }

NB: For the random googler coming accros this question you can also catch if a redirect was already performed (by your policy) with this ([catch {HTTP::payload replace 0 0 {}}])
Stanislas_Piro2
Cumulonimbus
May 08, 2019
If you are working with version 14.X, you can do the same within the policy.

create a policy rule at the end (named default for example):

without any condition

with action http-reply redirect

in options, select 301 response code (new in version 14.X)

in Location, use tcl:https://[HTTP::host][HTTP::uri]