Session table with Virtual Command

You're right, small data pckts because of ftp-control.

Below is the first iRule calling the second. And then the log. I'd be very interested to see what you think might be happening.

The log lookup of both the STRING value and the $var value on the second virtual server does not work, despite occurring later in time than when they are put in the tables. It seems like they are saved to different tables, or that, the table is somehow reset before the lookup. The IP::client_addr is the same on both virtual servers, so the key is consistent - at least, that's what the log says. When the key is set as a string, it doesn't work either.

iRule 1
 
when CLIENT_ACCEPTED {
   log local0.debug "client accepted VS1"
   log local0.debug "New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]"
   SSL::disable
   TCP::respond "220 My ftp server\r\n"
   TCP::collect 10
 
}
when CLIENT_DATA {
   log local0.debug "client data VS1"
   log local0.debug "[TCP::payload] is the payload VS1"
   log local0.debug "New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]"
   TCP::respond "234 AUTH TLS Successful\r\n"
   TCP::payload replace 0 [TCP::payload length] ""
   log local0.debug "[TCP::payload] is the payload (should be empty) VS1"
   log -noname local0.info "CLIENT_DATA     found client data"
   log -noname local0.info "CLIENT_DATA     send to virtual vs-test-02"
   virtual /Common/VIP2
   SSL::enable
   TCP::release
   log local0.debug "TCP Release Completed VS1"
}
when SERVER_CONNECTED {
    log local0.debug "This is server connected event VS1"
    log local0.debug "New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]"
	TCP::collect
}
when SERVER_DATA {
  log local0.debug "this is server data event VS1"
  log local0.debug "[TCP::payload] payload from server VS1"
  log local0.debug "New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]"
  if { [TCP::payload] contains "220 " } {
    TCP::payload replace 0 [TCP::payload length] ""
    log local0.debug "[TCP::payload] (empty) payload line (server data event line 27) on VS1"
  }
  TCP::release
  TCP::collect
}
when CLIENTSSL_CLIENTHELLO {
   log local0. "This is clientssl_clienthello - VS1"
}
when CLIENTSSL_CLIENTCERT {
  log local0. "This is clientssl_clientcert - VS1"
  set sidc [SSL::sessionid]
  log local0. "CLIENTSSL session ID is $sidc"
 
   set myCount [SSL::cert count]
   log local0. "Count of certificates is $myCount"
 
   set client_cert [SSL::cert 0]
 
<<EXTRACT CERT VALUE in $var local variable>>
   
   log local0. "this is VAR value $var"
   set srcip [IP::client_addr]
   table add -subtable "blacklist" $srcip "$var" 5 5
   log -noname local0.info "send to virtual vs-test-02"
   set result [table lookup -subtable "blacklist" $srcip]
   log -noname local0.info "result is $result"
    }
 
when CLIENTSSL_HANDSHAKE {
   log local0. "This is clientssl_handshake - VS1"
}
 when CLIENT_CLOSED {
  log local0.debug "Closed TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]"
 
   }

iRule 2
 
when CLIENT_ACCEPTED {
   log local0.debug "client accepted VS2"
   log local0.debug "New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]"
   TCP::release
   TCP::collect
}
when CLIENT_DATA {
  log local0.debug "[TCP::payload] VS2 client data event"
  log local0. "This is client data"
  log local0.debug [TCP::payload]
  log local0.debug "This is line 29"
  TCP::release
  TCP::collect
}   
when SERVER_CONNECTED {
  log local0.debug "VS2 server connected event - on inner F5 this is connection to FTP server"
  log local0.debug "New TCP connection from [IP::client_addr]:[TCP::client_port] to [IP::local_addr]:[TCP::local_port]"
  TCP::collect
}
when SERVER_DATA {
   log local0.debug "[TCP::payload] server data event VS2"
   TCP::release
   TCP::collect
}
when SERVERSSL_CLIENTHELLO_SEND {
   log local0. "This is SERVERSSL_CLIENTHELLO_SEND - VS2"
   TCP::collect
   TCP::release
}
when SERVERSSL_SERVERCERT {
   log local0. "This is SERVERSSL_SERVERCERT - VS2"
   set srcip [IP::client_addr]
   set result [table lookup -subtable "blacklist" $srcip]
   log -noname local0.info "SERVERSSL_SERVERCERT result for $srcip is $result."
   TCP::respond "VAR_$result\r\n"
   
}
when SERVERSSL_SERVERHELLO {
   log local0. "This is SERVERSSL_SERVERHELLO - VS2"
   
}
when SERVERSSL_HANDSHAKE {
   log local0. "This is SERVERSSL_HANDSHAKE - VS2"
  }
when SERVERSSL_DATA {
   log local0. "This is SERVERSSL_DATA - VS2"
   }