For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Ted_Waller_01_1's avatar
Ted_Waller_01_1
Icon for Altocumulus rankAltocumulus
Dec 16, 2014

Switch Statement Routing to Separate VS Using 'Virtual'

Good afternoon, I am trying to route traffic based upon a URI switch using -glob to a separate virtual server. I've read up on the 'virtual' command, and think I have the syntax right, but there's ...
application delivery
design
devops
iRules
LTM
Ted_Waller_01_1's avatar
Ted_Waller_01_1
Icon for Altocumulus rankAltocumulus
Dec 16, 2014

The return was only added after initial attempts that failed (exact same behavior) after finding a suggestion on a previous response here. I've also tried dropping down to the http version of the VS along with https. The issue seems to be it's just not assigning the traffic to the new VS despite the command being there.

Here's the first part of the iRule attached to the api_https (and api_http for that matter) virtual server. I only included the first part to show that immediately upon hitting the Vs, it should hit this iRule resulting in the log statement firing. I never receive that statement. Also, I can hit the api_https (or api_http) directly, so the IP restriction you see has been validated.

when HTTP_REQUEST {
    if { [IP::addr [IP::client_addr]/24 equals IP1]
        or [IP::addr [IP::client_addr]/23 equals IP2]} {
            log 10.10.0.9 local0.info "Host: [HTTP::host] -- URI: [HTTP::uri] " 

            ....
Amit_Karnik_269's avatar
Amit_Karnik_269
Icon for Nimbostratus rankNimbostratus
Dec 16, 2014
Just to rule it out do enable the api_https on all VLANs. When you hit it from the outside and when the traffic is shuffled from 1 virtual to another, there is a a subtle difference. You could also add a log statement in your iRule on api_https in the CLIENT_ACCEPTED event just to see if the connection is setup