For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Jobec_45051's avatar
Jobec_45051
Icon for Nimbostratus rankNimbostratus
Oct 21, 2011

ProxyPass v10.2 for APM - Why EXTERNAL data group?

Can someone explain why the data group for ProxyPass v10.2 has to be an external one? I tried using a simple string data group, and this seems to be working fine.

 

 

What are the problems I can run in to when using a string data group instead of a external string data group?

 

 

We use an active/standby setup of big ip's so I prefer the normal string data group type as this gets copied over to the standby when doing a config sync. The external file had to be edited on both units which may lead to inconsistencies.
application delivery
dev
devops
iRules

5 Replies

  • Michael_Yates's avatar
    Michael_Yates
    Icon for Nimbostratus rankNimbostratus
    Oct 21, 2011
    Hi iRuler,

     

     

    You can use either interchangeably.

     

     

    If your only concern is to have the External (Local File System) Data Group copied to the standby, then you can use either as well (if you store the Data Group in the default location) since they are captured and transferred as part of the Config Sync Process.

     

     

    Hope this helps.
  • Jobec_45051's avatar
    Jobec_45051
    Icon for Nimbostratus rankNimbostratus
    Oct 23, 2011
    Thanks Michael, that's a big help, certainly the part about the files in /config that are synchonized :)

     

     

    As a follow-up question: do you have any idea why the documentation states it has to be an external data group?
  • Michael_Yates's avatar
    Michael_Yates
    Icon for Nimbostratus rankNimbostratus
    Oct 24, 2011

     

    Configuration Requirements

     

    1) The ProxyPass iRule needs to be applied to an HTTP virtual server or

     

    an HTTPS virtual server with a clientssl profile applied to it.

     

    2) A data group (LTM -> iRules -> Data Groups tab) must be defined with

     

    the name "ProxyPassVIRTUAL" where VIRTUAL is the name of the virtual server

     

    (case-sensitive!). See below for the format of this data group (class).

     

    Note that this currently must be an EXTERNAL data group.

     

     

     

    I see what you are saying, but I cannot see any reason why the functionality would require it to be an External Data Group. Can you test it with a Non-External Data Group?
  • Jobec_45051's avatar
    Jobec_45051
    Icon for Nimbostratus rankNimbostratus
    Oct 28, 2011

    As I stated in my original question: it does work when using a normal data group.

     

    I was just wondering whether I would bump in to any problems by doing so.

     

     

    But either way, I can confirm that it's working.

     

     

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Oct 28, 2011
    I don't think there is a technical reason it should require an external datagroup. As of 10.1, internal and external datagropus offer the same functionality in terms of name=value pairing lookups:

     

     

     

    http://devcentral.f5.com/wiki/iRules.class.ashx

     

     

    Internal data groups were not able to make use of the name/value pairing with the := separator until version 10.1. As of 10.1 all classes support the name/value pairing.

     

     

     

    Aaron