For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Dan_Bowman's avatar
Dan_Bowman
Icon for Cirrus rankCirrus
Jul 31, 2019

Sideband iRulesLX to another virtual server?

Possibly a simple answer to this but not found any examples so far - I'm looking to intercept traffic to an existing virtual server, interrogate it and if needed send a sideband request with some of ...
application delivery
iRulesLX
Dario_Garrido's avatar
Dario_Garrido
Icon for Noctilucent rankNoctilucent
Jul 31, 2019

Hello Dan.

 

Everything depends on the specific details of your implementation, but reading your description I'm sure you can do it mostly using only iRules.

 

HSSR Documentation

https://clouddocs.f5.com/api/irules/HTTP-Super-SIDEBAND-Requestor-Client-Handles-Redirects-Cookies-Chunked-Transfer-APM-Access-etc.html

 

A practical example of using it:

https://clouddocs.f5.com/api/irules/Query-LDAP-From-An-iRule-And-Or-Use-APM-With-Non-HTTP-Services.html

 

Base on the info above, you can check something in your incoming request and use HSSR to send the initial info to another VS.

 

KR,

Dario.

  • Dan_Bowman's avatar
    Dan_Bowman
    Icon for Cirrus rankCirrus
    Aug 01, 2019

    Thanks Dario - We need to make some fairly complex calls including generating a signed JWT token before initiating the sideband connection, that JWT is then used to request an access token from API 1 - we then need to use that token to make a second sideband call to API 2 and use it to validate some of the header info from the initial HTTP request, hence me looking at using iLX! 😀 - I'm much more familiar with regular iRules so if the same could be achieved that way I'd be happier!

     

    If anyone can shed any light on the iLX > Virtual server sideband methods I'd be appreciative.

     

    Fallback position is to offload this work to a web service on an application server but that will add another tier of infrastructure to the process, so I'd like to try and explore the options of doing this on-box if we can.

     

    Thanks,

     

    Dan

    • Dario_Garrido's avatar
      Dario_Garrido
      Icon for Noctilucent rankNoctilucent
      Aug 01, 2019

      Then I recommend you to use iRulesLX better.

       

      Here you have a good example.

      https://devcentral.f5.com/s/articles/irules-lx-sideband-connection-1162

       

      Also, some doc of how to start with iRulesLX

      https://devcentral.f5.com/s/articles/getting-started-with-irules-lx-introduction-conceptual-overview-20409

      https://devcentral.f5.com/s/articles/introducing-irules-lx-19888

       

      KR,

      Dario.