For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

kneebolt_142346's avatar
kneebolt_142346
Icon for Nimbostratus rankNimbostratus
May 28, 2014

Redirect IP to specific node or gateway

We have one set of IP's that due to the previous network that had them, we get blocked from a few sites. We have a backup ISP, and until we get a new block to eliminate this problem, Id like to be ab...
kneebolt_142346's avatar
kneebolt_142346
Icon for Nimbostratus rankNimbostratus
May 29, 2014

This would seem to be my problem, from the article you linked:

 

If a Standard virtual server is configured with Layer 7 functionality, such as an HTTP profile, the client must send at least one data packet before the server-side connection can be initiated by the BIG-IP LTM system.

 

That is what I THINK is happening. If I do a tcpdump on one of the blocked IP's, I see one syn packet going out Cogent, with no reply. It would seem that without the reply, the rule doesn't trigger. But without the http profile, I cant use the http_request event. And the other lower level events, like Client_Connected never get past the syn packet either, so I don't see how they would work?

 

Thanks by the way for all the suggestions, I really feel like I should be able to get this to work. We load balance the two ISP's already, so if were to mark Cogent down, everyone would go out Charter and it would be fine. But trying to only do it for one site seems to be more trouble than I expected, at least based on what little I know of iRules :)