trying to call external web service to determine VPN access

Bob,

First, your observation is correct - you cannot call out from the iRules using tcl http routines. We do have other ways of being able to do it - sideband connections - https://devcentral.f5.com/articles/v11-irules-intro-to-sideband-connections - but I don't think you will need to go that deep into the weeds.

Instead, I suggest you try to leverate APMs GUI-based HTTP AAA server capability. In essence, when you create it, you are going to be sending anything you want to an HTTP server and getting a response back - and making a decision based upon that response. That should be quite elegant and require no iRules. You would most likely need to do a custom POST action for your HTTP Auth AAA server that will validate your MAC address, and that should be sufficient.