For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

gomebe_33353's avatar
gomebe_33353
Icon for Nimbostratus rankNimbostratus
May 11, 2016

TCL error

TCL error: /Common/v3CSR-IP-CHECK - invalid IP network mask specification (line 9)invalid IP match item 63.x.x.x 64.x.x.x for IP class /Common/v2whitelist_client (line 9) invoked from within "class ...
application delivery
BIG-IP
devops
LTM
Yann_Desmarest's avatar
Yann_Desmarest
Icon for Cirrus rankCirrus
May 11, 2016

Hello,

When you have more than one IP address in the X-Forwarded-For header, your irule generate this tcl error.

You should replace

if { [class match [HTTP::header values "X-Forwarded-For"] equals v2whitelist_client] } {
    log local0. "Allowed Request From: [IP::remote_addr]"
} else {
    HTTP::redirect "http://www.domains/errors/error.html"
    log local0. "Denied Request From: [IP::remote_addr]"
}

by : 

foreach ipaddress [HTTP::header values "X-Forwarded-For"] {
    if { [class match $ipaddress equals v2whitelist_client] } {
        log local0. "Allowed Request From: [IP::remote_addr]"
    } else {
        HTTP::redirect "http://www.domains/errors/error.html"
        log local0. "Denied Request From: [IP::remote_addr]"
    }
}