For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Bayan_El_Ameen1's avatar
Bayan_El_Ameen1
Icon for Nimbostratus rankNimbostratus
Oct 04, 2011

Redirection iRule on ASM Blocking

Hello,

 

 

I need an iRule to redirect to home page when the ASM blocks a request.

 

 

I know that this can be achieved by selecting a redirect url for the response page instead of using the default response page but I need something more general for I have multiple applications and I want to manage that in an iRule.

 

 

I have tried the following iRule but it's not working:

 

 

when ASM_REQUEST_BLOCKING {

 

HTTP::redirect https://[HTTP::host]/

 

}

 

 

Thanks,

 

 

Bayan El Ameen

 

 

 

 

application delivery
dev
devops
iRules

22 Replies

Show More
  • Kurt_Knochner_5's avatar
    Kurt_Knochner_5
    Icon for Cirrus rankCirrus
    Oct 31, 2011
    O.K. could still be a bug. What happens if you use HTTP::respond instead of HTTP::redirect?

     

     

    HTTP::respond 302 Location "http://www.google.com"

     

     

    Does it work? Are there any errors in the log?

     

     

    Regards

     

    Kurt Knochner
  • Torti's avatar
    Torti
    Icon for Cirrus rankCirrus
    Oct 31, 2011
    ok,

     

    i will wait a little bit before i open one. perhaps another user has a solution.

     

     

    Is there a way to remove the Server from the HTTP-Header? I dont want, everyone to know our bigip.
  • Kurt_Knochner_5's avatar
    Kurt_Knochner_5
    Icon for Cirrus rankCirrus
    Oct 31, 2011
     
when HTTP_RESPONSE {

   HTTP::header remove "Server"

    better replace it, instead of removing, otherwise some system might not accept your HTTP response

    HTTP::header replace Server "Sioux Server 3.14159"
}

    Regards

    Kurt Knochner
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Oct 31, 2011
    i just wonder if HTTP::header remove in HTTP_RESPONSE event can remove Server header in this case since the Server header is generated by HTTP::redirect command in ASM_REQUEST_BLOCKING event.

    anyway, in ltm, i use noserver flag in HTTP::respond command.

    HTTP:::respond wiki

    http://devcentral.f5.com/wiki/iRules.HTTP__respond.ashx 

    [root@iris:Active] config  b virtual bar list
virtual bar {
   snat automap
   pool foo
   destination 172.28.17.33:http
   ip protocol tcp
   rules myrule
   profiles {
      http {}
      tcp {}
   }
}
[root@iris:Active] config  b rule myrule list
rule myrule {
   when HTTP_REQUEST {
        HTTP::respond 302 noserver Location "http://www.google.com"
}
}
[root@iris:Active] config  curl -I http://172.28.17.33
HTTP/1.0 302 Found
Location: http://www.google.com
Connection: Keep-Alive
Content-Length: 0
  • Torti's avatar
    Torti
    Icon for Cirrus rankCirrus
    Nov 02, 2011
    the solution of Kurt doesn't work :-( - sry Kurt

     

    but the solution of nitass is working fine - thx nitass

     

     

    now, the only problem is the error message (Invalid action EV_INGRESS_DATA during ST_HTTP_PREPEND_HEADERS)
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Nov 02, 2011
    now, the only problem is the error message (Invalid action EV_INGRESS_DATA during ST_HTTP_PREPEND_HEADERS)if nothing can be found in askf5, i recommend opening a support case. so, support engineer can help you to find what wrong is.

     

     

    and if you don't mind, could you please update us the finding?

     

     

    thanks a lot!
  • Kurt_Knochner_5's avatar
    Kurt_Knochner_5
    Icon for Cirrus rankCirrus
    Nov 03, 2011

    > i just wonder if HTTP::header remove in HTTP_RESPONSE event can

     

    > remove Server header in this case since the Server header is generated

     

    > by HTTP::redirect command in ASM_REQUEST_BLOCKING event.

     

     

    good point!

     

     

    Regards

     

    Kurt Knochner