For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

yuanqiang_22112's avatar
yuanqiang_22112
Icon for Nimbostratus rankNimbostratus
Jul 17, 2016

TCP:OPtion set irules , please help me !!!

The folowing is my configuration: *** TCP::option irulse:** when SERVER_CONNECTED { scan [IP::client_addr] {%d.%d.%d.%d} a b c d TCP::option set 29 [binary format cccc $a $b $c $d] all set a [binary format cccc $e $b $c $d] log "insert ip to tcp option $a" } * TCP profile tmsh create ltm profile tcp tcpname tcp-options "{8 first} {28 last}"

 

I don't know why irules report errors ,and not how to solve the question ;please help me solve the quesion and insert client real ip .Thanks , please!!!

 

4 Replies

  • JG's avatar
    JG
    Icon for Cumulonimbus rankCumulonimbus

    You already have a post about this issue. Anyhow if you put this irule in, what do you get in the log?

    when SERVER_CONNECTED {
      log local0. "Client address is : [IP::client_addr]"
    }
    
  • JG's avatar
    JG
    Icon for Cumulonimbus rankCumulonimbus

    Please make that irule to contain that logging line only. This is just to find out the format of the IP address the irule is getting.

     

  • JG's avatar
    JG
    Icon for Cumulonimbus rankCumulonimbus

    The log entries show you still have the old irule in place. Please remove that irule and use the one I posted.

     

  • so that iRule comes from the devcentral wiki entry on TCP::option, did you read that whole section?

    it mentions changing your TCP profile with the tcp-option setting (seems CLI only), i got the same error until i created a second TCP profile like.

    create ltm profile tcp tcp-opt-change tcp-options "{29 last}"

    but are you sure this is going to do what you want? it suggests something like adding the client IP, but that option 29 seems not meant for that. it might be a typo and should say 28, but even if you do that it all depends on the receiving system understanding what you do and looking at that.