Forum Discussion
Peter_Baumann
Cirrostratus
CirrostratusTCL error command returned bad code: 18 after upgrade to v11.1.0
This is driving me nuts!
I have the following iRule attached to a VS:
when CLIENT_ACCEPTED {
if {[class match [IP::client_addr] equals User_Internal]} {
SSL::profile clientssl_domain.net
} else {
SSL::profile clientssl_domain.net_cert
}
}
This iRule was working in version 10.2.1, after upgrading to v11.1.0 HF1 the exactly same iRule doesn't work anymore.
I get the following:
Feb 6 14:02:35 tmm err tmm[7218]: 01220001:3: TCL error: /Common/Require_SSL_Cert_domain.net - command returned bad code: 18 while executing "if {[class match [IP::client_addr] equals User_Internal]} { SSL::profile clientssl_domain.net } else { SSL::profile clientssl_domain.net_cert ..."
It seems impossible to troubleshoot this error. I cannot find any information about "bad code 18" or howto find out what is wrong with this code.
When we remove the SSL::profile the rule is working, so it is not the problem with the class match line.
Anyone have a hint how to solve this problem?
Thank you
5 Replies
- nitass
Employee
Bug 370572 - profile search does not use folder based common profile search mechanism and search failure does not return normal TCL_ERROR
can you try this workaround?root@ve1100(Active)(/Common)(tmos) list ltm rule myrule ltm rule myrule { when CLIENT_ACCEPTED { if {[class match [IP::client_addr] equals User_Internal]} { SSL::profile /Common/clientssl_domain.net } else { SSL::profile /Common/clientssl_domain.net_cert } } } - Peter_BaumannHi nitass,
Thank you very much for your hint!
This was exactly the problem.
We changed now all the iRules to "full path" entries and we will try if this is working in version 10.2.1 to do a smooth upgrade in production environment to v11.1.0. - nitassWe changed now all the iRules to "full path" entries and we will try if this is working in version 10.2.1i do not think it works in 10.x. the bug 370572 is found on 11.0.0 HF1 and will be fixed in later release.
- Peter_BaumannWell it seems that the "full path" is not working with 10.2.1, we get the following error:
Feb 7 08:47:25 local/tmm err tmm[5116]: 01220001:3: TCL error: Require_SSL_Cert_domain.net - wrong args: should be "SSL::profile " while executing "SSL::profile /Common/clientssl_domain.net
This is really bad to upgrade so many iRules in use with the "full path".
Is there maybe a hotfix available so that we don't need to change so many iRules when we do the upgrade during the night at the maintenance window?
Thank you - nitassIs there maybe a hotfix available so that we don't need to change so many iRules when we do the upgrade during the night at the maintenance window? you have to open a support case and request for engineering hotfix.
cheer!
